sbox version 1.04, the CGI wrapper that allows for safer execution of scripts, has a path disclosure vulnerability.