Metaways Tine 2.0 allows remote attackers to obtain sensitive information via unknown vectors in (1) Crm/Controller.php (2) Crm/Export/Csv.php or (3) Calendar/Model/Attender.php which reveal the full installation path.