CVE-2008-7254: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in includes/template-loader.php in Irmin CMS formerly Pepsi CMS 0.5 and 0.6 BETA2, when registerglobals is enabled, allows remote attackers to include and execute arbitrary files via a .. dot dot in the RootPath parameter. NOTE: some of these details are obtained...