Gentoo Linux Security Advisory GLSA 200503-02 – It was discovered that phpBB contains a flaw in the session handling code and a path disclosure bug. AnthraX101 discovered that phpBB allows local users to read arbitrary files, if the Enable remote avatars and Enable avatar uploading options are set (CVE-2005-0259). He also found out that incorrect input validation in usercp_avatar.php and usercp_register.php makes phpBB vulnerable to directory traversal attacks, if the Gallery avatars setting is enabled (CVE-2005-0258). Versions less than 2.0.13 are affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/36412/glsa-200503-02.txt
Source: https://packetstormsecurity.com/files/36412/Gentoo-Linux-Security-Advisory-200503-2.html