Chain: external control of values for user's desired language and theme enables path traversal.
CVE-2009-1936
Chain: library file sends a redirect if it is directly requested but continues to execute, allowing remote file inclusion and path traversal.
+ Potential Mitigations