A user has use of an application running on a Linux server. The application provides the user with an API that allows reading and writing files on the server, but does not offer any means of executing a file. Is that enough to ensure the user cannot execute commands on the server?
The underlying filesystem is not mounted with noexec.
The user can choose which file to read and write, and can create new files with arbitrary names. The user can delete files.
The application does not have access to "system" files, running as a relatively standard unprivileged user account similar to what a desktop user would have.