Directory traversal vulnerability in productionnu2/fileuploader.php in nuBuilder 10.04.20 and possibly other versions before 10.07.12 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the dir parameter.