Apparently the upload directory is the same as the script directory, which is not good. If you upload a file named "cgi.py", it will be imported next time someone runs the script. No directory traversal needed to exploit this.
I asssumed that the script would not be restarted, but you're totally right.
Thanks for the comment :)