CVE-2010-0467
Newsletter module allows reading arbitrary files using "../" sequences.
CVE-2006-7079
Chain: PHP app uses extract for register_globals compatibility layer (CWE-621), enabling path traversal (CWE-22)