CVE-2018-9205: Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion

In avatar_uploader v7.x-1.0-beta8 the view.php program doesn't restrict file paths, allowing unauthenticated users to retrieve arbitrary files.