An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to popup.jsp.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')