FYI: milw0rm 4071 is sort of true -- the RFI flaw does exist, but by default there's a .htaccess file in saf/lib/PEAR/PhpDocumentor that prevents access to that directory tree. George -- theall at tenablesecurity.com