A directory traversal issue exists when `magic quotes gpc` is disabled and `register globals` is enabled, allowing remote attackers to include and execute arbitrary local files via directory traversal sequences in the `set[template][value]` parameter.