Directory traversal vulnerability in index.php in Fantastico, as used with cPanel 11.x, allows remote attackers to read arbitrary files via a .. (dot dot) in the sup3r parameter.
https://exchange.xforce.ibmcloud.com/vulnerabilities/46991
http://www.securityfocus.com/archive/1/498814/100/0/threaded