Directory traversal vulnerability in jretest.html in WebConnect 6.5 and 6.4.4 and possibly earlier versions allows remote attackers to read keys within arbitrary INI formatted files via \..//\ sequences in the WCP_USER parameter.