CVE-2011-0505: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in system/system.php in Zwii 2.1.1, when magicquotesgpc is disabled and registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the settemplatevalue parameter...