Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09 when used on a case-insensitive web site allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ss_uri parameter in conjunction with a modified component name.