Directory traversal vulnerability in GNUMP3D before 2.9.6 allows remote attackers to read arbitrary files via crafted sequences such as \/.//..//////././\ which is collapsed into \/.././\ after \..\ and \//\ sequences are removed.