Directory traversal vulnerability in connector.php in the fckeditor2rc2 addon in DoceboLMS 2.0.4 allows remote attackers to list arbitrary files and directories via ".." sequences in the Type parameter in a GetFoldersAndFiles command.
https://exchange.xforce.ibmcloud.com/vulnerabilities/23518
http://www.vupen.com/english/advisories/2005/2771