Fixed path disclosure due to Null-Byte (%00) attack at the URI in system/engine/action.php
Details: http://www.exploit-db.com/exploits/17108/