The expand_template function in afuse.c in afuse 0.2 allows local users to gain privileges via shell metacharacters in a pathname.

More... (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2232)