Directory traversal vulnerability in index.php in MiniGal b13 (aka MG2) allows remote attackers to read the source code of .php files and possibly the content of other files via a .. (dot dot) in the list parameter.