Authenticated file disclosure via unchecked download path

Path traversal in the ScormAicc module of ILIAS 7.25 allows remote authenticated users to read files accessible to the web server. The downloadExportFile action accepts the file URL parameter as a filesystem path without confining it to the export directory, so traversal sequences select files outside the document root. A tutor-level account with permission to edit an ILIAS learning module is sufficient, and disclosure is limited to files readable by the www-data account.