In the nextgen-gallery plugin prior to 2.2.50 for WordPress, gallery paths are not secured.
imagely nextgen gallery