CVE-2009-4415: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to 1 read arbitrary files via the csvfile parameter to addressbook/csvimport.php, or 2 include and execute arbitrary local files via the convtype parameter...