security bug, low, Information Disclosure

[VedranIteh]

Webalizer module references directly to directory structure in the URL but doesn't sanitize input allowing to read other users stats by traversing in their dirs.

Example:
https://example.com/?module=webalizer_stats&show=true&domain=../other_user/domain

[TGates71]

Resolved in v2?

[Dukecitysolutions]

Resolved!