ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files.
chronoengine chronoforums 7.0.7