Block_render_url.class in PHPSlash 0.6.1 allows remote attackers with PHPSlash administrator privileges to read arbitrary files by creating a block and specifying the target file as the source URL.
| Software | From | Fixed in |
|---|---|---|
| phpslash / phpslash | 0.5.3.2 | 0.5.3.2.x |
| phpslash / phpslash | 0.6.1 | 0.6.1.x |