Directory traversal vulnerability in Gallery 2.0.3 and earlier and 2.1 before RC-2a allows remote attackers to include arbitrary PHP files via \..\ (dot dot) sequences in the stepOrder parameter to (1) upgrade/index.php or (2) install/index.php.