MacOS X Server 10.5 [1], also known as Leopard Server features a Wiki Server [2], which is a multiuser web application written in Python. The Leopard bundled Wiki Server is vulnerable to a path traversal attack, which can be exploited by non-privileged system users via a forged file upload to write arbitrary files on locations in the server filesystem, restricted only by privileges of the Wiki Server application.
http://www.securiteam.com/securitynews/5RP0I2KNPY.html
