joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal.
joyplus-cms project joyplus-cms 1.6.0