CVE:CVE-2009-2184
CNNVD:CNNVD-200906-383
Gravy Media Photo Host 1.0.8版本的forcedownload.php中存在完全路径游历漏洞。远程攻击者可以借助文件密码参数中一个编码的"/"，读取任意文件。
solution:Upgrade gravy-media media_photo_host to a higher version than 1.0.8,and avoid the version 1.0.8