Flatnuke · Flatnuke · CVE-2005-3307
**Name of the Vulnerable Software and Affected Versions**
FlatNuke version 2.5.6
**Description**
The issue allows remote attackers to read arbitrary files via ".." sequences in the `user` parameter in a profile operation or the `quale` parameter in a newtopic operation, specifically in the index.php file.
**Recommendations**
For FlatNuke version 2.5.6, consider restricting access to the index.php file until a patch is available, and avoid using the `user` parameter in profile operations and the `quale` parameter in newtopic operations to minimize the risk of exploitation.