We upgraded to 7.2.6 but the directory traversal bug or file inclusion bug is still not fixed. You can download any file through TemplateMsg.js.zgz
Originally Posted by phoenix
The wellknown example:
After fixing this bug everyone should change the master passwords in the localconfig.xml, especially mysql and ldap.