There's always a risk that someone can take advantage of a bug or gain privileged access, especially using a cleartext transfer protocol like FTP. The hazard mostly lay in your permissions granted to the user and how you sandbox each user in.
A blanket security checklist isn't necessarily applicable because we don't know how you're implementing this in the first place; the server OS, the server for content, how you're jailing them, etc.
And security is a process, not a checklist.
Really the only thing I could tell you is assume all your users are malicious, sandbox them as much as possible, check your permissions on subdirectories to grant the least privileges necessary and make sure you have good backups and a file checker that does checksums in place to check for malicious activity as well as a good update procedure in place to keep the latest patches applied. Beyond that there's not much detail to your question and the question is so wide that the topic can fill a book...