to fix this bug, vendor have just to put an .htaccess "inc" folder with the following code Deny from all or rename the file to lib.inc.php Regards