Directory traversal in Wcms 0.3.2 allows an malicious user to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php.
wcms wcms 0.3.2