Multiple directory traversal vulnerabilities in ShowOff! 1.5.4 allow remote attackers to read arbitrary files via \..\ sequences in arguments to the (1) ShowAlbum (2) ShowVideo or (3) ShowGraphic scripts.