Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the (1) optionlanguage and (2) optiontemplate parameters and (3) possibly other parameters to (a) admin.php and (b) other unspecified scripts. NOTE: the admin.php/optionlanguage vector can be used by remote unauthenticated attackers to include arbitrary files in conjunction with CVE-2006-1085.