Directory traversal vulnerability in the Web Calendaring server in Ipswitch Imail 8.13 and other versions before IMail Server 8.2 Hotfix 2 allows remote attackers to read arbitrary files via \..\\\ (dot dot backslash) sequences in the query string argument in a GET request to a non-existent .jsp file.