In MyBB prior to 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter.
mybb mybb