Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.