Directory traversal vulnerability in Vis.pl as part of the FACE CONTROL product allows remote attackers to read arbitrary files via a .. (dot dot) in any parameter that opens a file such as (1) s or (2) p.