CVE-2008-2863: Improper Limitation of a Pathname to a Restricted Directory

Multiple absolute path traversal vulnerabilities in eLineStudio Site Composer ESC 2.6 allow remote attackers to create or delete arbitrary directories via a full pathname in the inpCurrFolder parameter to 1 folderdel.asp or 2 foldernew.asp in cms/assetmanager/...