CVE-2020-11819: Improper Limitation of a Pathname to a Restricted Directory

In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution...