OpenRefine up to and including 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file.
openrefine openrefine