Craft CMS prior to 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.
craftcms craft cms