Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.