Directory traversal vulnerability in sendcard.php in Sendcard 3.4.1 and earlier allows remote attackers to read arbitrary files via a full pathname in the form parameter.
https://www.exploit-db.com/exploits/3827
https://exchange.xforce.ibmcloud.com/vulnerabilities/33995