Absolute path traversal vulnerability in convert.cgi in Quirex 2.0.2 and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary code via the (1) quiz_head (2) quiz_foot and (3) template variables.