Directory traversal vulnerability in theme/acgv.php in ACGVannu 1.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the rubrik parameter.
https://www.exploit-db.com/exploits/3867
https://exchange.xforce.ibmcloud.com/vulnerabilities/34108