Multiple directory traversal vulnerabilities in enomphp 4.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter to (1) config.php (2) ranklv_inside.php (3) rankml_inside.php and (4) admin/Restore/config.php.