The Photos in Wifi application 1.0.1 for iOS has directory traversal via the ext parameter to assets-library://asset/asset.php.
- https://www.vulnerability-lab.com/get_content.php?id=1600
No PoCs found on GitHub currently.