The XCloner component before 3.5.4 for Joomla! allows Authenticated Local File Disclosure.