In NCH WebDictate v2.13 and previous versions, authenticated users can abuse logprop?file=/.. path traversal to read files on the filesystem.
nch webdictate