diff -u a/web/graph.php-orig b/web/graph.php
--- a/web/graph.php-orig	2012-07-15 13:56:07.004566423 +0100
+++ b/web/graph.php	2012-07-15 13:56:17.082752514 +0100
@@ -122,7 +122,7 @@
 
 $graph_file = "$graphdir/$graph.php";
 
-if ( is_readable($graph_file) ) {
+if ( is_readable($graph_file) and realpath($graphdir) === dirname(realpath($graph_file)) ) {
     include_once($graph_file);
 
     $graph_function = "graph_${graph}";