phpBB HTML template files are parsed and executed as PHP code. Therefore anyone with access to the template files can execute php code on the system.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/45503/phpBB-template.txt
Source: https://packetstormsecurity.com/files/45503/phpBB-template.txt.html