The ImageGalleryPlugin (ImageGalleryPlugin.pm) in Twiki allows remote malicious users to execute arbitrary commands via certain commands that generate thumbnails.
twiki imagegalleryplugin