NCH IVM Attendant v5.12 and previous versions allows path traversal via viewfile?file=/.. to read files.
nchsoftware ivm attendant