CVE-2008-6172: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in captcha/captchaimage.php in the RWCards comrwcards 3.0.11 component for Joomla!, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter...