The "th1-docs" setting:

If enabled, this allows embedded documentation files to contain arbitrary TH1 scripts that are evaluated on the server. If native Tcl integration is also enabled, this setting has the potential to allow anybody with check-in privileges to do almost anything that the associated operating system user account could do. Extreme caution should be used when enabling this setting.