Directory traversal vulnerability in TinyPHPForum 3.6 and earlier allows remote attackers to create a new user account create a new topic or view the profile of a user account as demonstrated via a .. (dot dot) in the uname parameter to profile.php.