Directory traversal vulnerability in codebrowserpntm.php in pnTresMailer 6.0.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the filetodownload parameter.
https://exchange.xforce.ibmcloud.com/vulnerabilities/18263
https://euvd.enisa.europa.eu/vulnerability/EUVD-2004-1203