Directory traversal vulnerability in Nexgen FTP Server before 2.2.3.23 allows remote authenticated users to read or list arbitrary files via (1) \..\ (2) \\\..\\\ (backslash dot dot) or (3) \/../\ sequences in (a) RETR (get) (b) NLST (ls) (c) LIST (ls) (d) RNFR or (e) RNTO FTP commands.