GetFile.aspx in Planet eStream prior to 6.72.10.07 allows ..\ directory traversal to read arbitrary local files.
planetestream planet estream