There was a new vuln released in phpBB today.... Don't upload your own avatar ;)