SibSoft Xfilesharing up to and including 2.5.1 allows op=page&tmpl=../ directory traversal to read arbitrary files.
sibsoft xfilesharing