Directory traversal vulnerability in Mike Spice My Calendar before 1.5 allows remote attackers to write arbitrary files via .. (dot dot) sequences in a URL.
https://exchange.xforce.ibmcloud.com/vulnerabilities/7966
http://www.securityfocus.com/bid/3856