hinge has reported a vulnerability in IOServer, which can be exploited by malicious people to disclose certain sensitive information.

Input appended to the URL is not properly sanitised before being used to display files. This can be exploited to download and disclose the contents of arbitrary files via directory traversal sequences.

Successful exploitation requires that "XML Server" is enabled and that the "Root Directory" setting does not contain a trailing backslash.

The vulnerability is reported in version 1.0.18.0. Prior versions may also be affected.

Solution
Update to version 1.0.19.0.

Provided and/or discovered by
hinge

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.foofus.net/?page_id=616

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers