Directory traversal vulnerability in Astaro Security Linux 6.0 when using Webmin allows remote authenticated webmin users to read arbitrary files via a .. (dot dot) in the wfe_download parameter to index.fpl.