Community Builder Enhanced
The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the `tabname` parameter in a "userProfile" action to "index.php". This can be leveraged to execute arbitrary code by using the file upload feature.