Launchpad.net

CVE 2006-2563

The cURL library (libcurl) in PHP 4.4.2 and 5.1.4 allows attackers to bypass safe mode and read files via a file:// request containing null characters.

See the CVE page on Mitre.org for more details.