The (1) modules.php (2) block-Calendar.php (3) block-Calendar1.php (4) block-Calendar_center.php scripts in NukeCalendar 1.1.a as used in PHP-Nuke allow remote attackers to obtain sensitive information via a URL with an invalid argument which reveals the full path in an error message.