AChecker 1.5 allows remote attackers to read the contents of arbitrary files via the download.php path parameter by using Unauthenticated Path Traversal. This occurs through readfile in PHP. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
https://github.com/piuppi/Proof-of-Concepts/blob/main/AChecker/CVE-2024-34523.md
https://github.com/inclusive-design/AChecker/blob/main/checker/download.php