CS-Forum before 0.82 allows remote attackers to obtain sensitive information via unspecified manipulations possibly involving an empty collapse or readall parameter to index.php which reveals the installation path in an error message.