Directory traversal vulnerability in index.php in UNIDOmedia Chameleon LE 1.203 and earlier, and possibly Chameleon PRO, allows remote attackers to read arbitrary files via the rmid parameter.
https://exchange.xforce.ibmcloud.com/vulnerabilities/27898
http://www.vupen.com/english/advisories/2006/2948
http://www.securityfocus.com/archive/1/440765/100/0/threaded