CVE:CVE-2006-3954
CNNVD:CNNVD-200608-004
MyBB (aka MyBulletinBoard) 1.x的usercp.php脚本存在目录遍历漏洞，远程攻击者可以借助(1)avatar操作或(2)do_avatar或中的gallery参数（该参数中包含..）读取任意文件。
solution:Upgrade mybulletinboard mybulletinboard to a higher version than 1.0.1,1.0.2,1.0.3,1.0.4,1.0_final,1.0_pr2,1.0_preview_release_2,1.00_rc1,1.00_rc2,1.0_rc2,1.00_rc3,1.0_rc4,1.00_rc4,1.00_rc4_security_patch,1.01,1.1,1.1.1,1.1.2,1.1.3,1.1.4,1.1.5,1.1.7,1.04,1.10,1.14,1.20,and avoid the version 1.0.1,1.0.2,1.0.3,1.0.4,1.0_final,1.0_pr2,1.0_preview_release_2,1.00_rc1,1.00_rc2,1.0_rc2,1.00_rc3,1.0_rc4,1.00_rc4,1.00_rc4_security_patch,1.01,1.1,1.1.1,1.1.2,1.1.3,1.1.4,1.1.5,1.1.7,1.04,1.10,1.14,1.20