SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable directory, then executing that script to gain normal shell access.
https://exchange.xforce.ibmcloud.com/vulnerabilities/8908
https://euvd.enisa.europa.eu/vulnerability/EUVD-2002-1694