123flashchat server versions 5.1 and below suffer from directory traversal attacks that allow for arbitrary file creation.