Directory traversal vulnerability in setcookie.php in PBLang 4.65 and possibly earlier versions allows remote attackers to read arbitrary files via \..\ sequences and \%00\ (trailing null byte) in the u parameter.