Multiple directory traversal vulnerabilities in (1) document.php or (2) insertMyDoc.php in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote project administrators to upload arbitrary files.
https://exchange.xforce.ibmcloud.com/vulnerabilities/20287
http://www.securityfocus.com/bid/13407
http://www.claroline.net/news.php#85
http://securitytracker.com/id?1013822
http://secunia.com/advisories/15725