CVE-2018-16831: Improper Limitation of a Pathname to a Restricted Directory

Smarty before 3.1.33-dev-4 allows attackers to bypass the trusteddir protection mechanism via a file:./../ substring in an include statement...