phpBB versions 2.3.10 and below are susceptible to a directory traversal attack via the attachment module.