Since the Attachment MOD user interface is not fully filtered with the file name data, through the HTTP POST, the file name containing multiple '..' characters can be bypass the Web root limit, view the system file content in user process rights.
1) Run a new post, add a file via "Add Attachment".
2) View the source code before you click Send.
3) Modify the
