OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file.