CVE-2019-18951: Improper Limitation of a Pathname to a Restricted Directory

SibSoft Xfilesharing through 2.5.1 allows op=page&tmpl=../ directory traversal to read arbitrary files...