cutenews 1.4.1 allows any user to access arbitrary files due to lack of sanitization of the "archive" parameter.