The "th1-docs" setting:

If enabled, this allows embedded documentation files to contain
arbitrary TH1 scripts that are evaluated on the server.  If native
Tcl integration is also enabled, this setting has the
potential to allow anybody with check-in privileges to
do almost anything that the associated operating system
user account could do.  Extreme caution should be used
when enabling this setting.