There's an update for Avatar Hack that fixes a user being able to select any graphic on your website by using relative URLs. To fix this security problem, just replace your ubb_avatar.cgi with the one from this ZIP file.
Donate to UBBDev today to help aid in Operational, Server and Script Maintenance, and Development costs.
Please also see our parent organization VNC Web Services if you're in the need of a new UBB.threads Install or Upgrade, Site/Server Migrations, or Security and Coding Services.