source: https://www.securityfocus.com/bid/12406/info

Xoops Incontent module is reported prone to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input.

A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory.

Incontent version 3.0 is reported to be susceptible to this vulnerability. Other versions may also be affected. 

http://www.example.com/modules/incontent/index.php?op=aff&option=0&url=../../. ./index.php

http://www.example.com/modules/incontent/index.php?op=aff&optio n=0&url=../../../mainfile.php