even you enable secrity .trusted_dir can be bypassed

if you enable secrity .$trusted_dir is an array of all directories that are considered trusted. Trusted directories are where you keep php scripts that are executed directly from the templates . the attackers can use ../ to bypass the dir ,if they can editing the templates, they read any file they want. just use {include "file:./../../../../../etc/passwd"}  