The XCloner component prior to 3.5.4 for Joomla! allows Authenticated Local File Disclosure.
xcloner xcloner