Authenticated file disclosure via filename path traversal

Path traversal in sys_verifies.php in DedeCMS 5.7.114 allows remote authenticated users to read arbitrary server files via filename. The action=view handler resolves the filename parameter without restricting parent-directory sequences, allowing the path to escape its intended directory. Low-privileged access to the administrative endpoint is required, and exploitation exposes files readable by the web-server account without altering data.