Eyoucms 1.5.4 is vulnerable to Directory Traversal. Due to a lack of input data sanitizaton in param tpldir filename type nid an attacker can inject \../\ to escape and write file to writeable directories.