-template-..-2f..-2f..-2f..-2froot-2f -

In plain terms, decodes to:

$file = $_GET['file']; include("/var/www/templates/" . $file); -template-..-2F..-2F..-2F..-2Froot-2F

In URLs, certain characters must be encoded using % followed by two hexadecimal digits. For example: In plain terms, decodes to: $file = $_GET['file'];