PhpNewsManager version 1.46 allows for arbitrary file reading due to being susceptible to a directory traversal attack.