Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e in the image path as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd.