Samba versions 2.2.11 and below and versions below and equal to 3.0.5 allow a remote attacker that ability to gain access to files that exist outside of the share’s defined path. Such files must still be readable by the account used for the connection.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/34542/samba22x.txt
Source: https://packetstormsecurity.com/files/34542/samba22x.txt.html