CVE-2008-2913

Concretely, CVE-2008-2913 affects Devalcms 1.4a and its func.php, where directory traversal is possible when magic_quotes_gpc is disabled. An attacker can use a .. in the currentpath parameter together with certain .../..... sequences in the currentfile parameter to trigger index.php and include/...