which do you mean "you" ?

Perhaps, "directory traversal" would be irrelevant with this issue.

Quote:"tar.gz" is the only exception. (treated as .tgz innerly)
You can upload foo.tar.gz with the setting on.

Quote:
I don't recommend "disable the setting".
There are some modules with the vulnerability about multiple dot. (Just checking by a simple black list...)

You know these files can be treated as parsable PHP with apache.

foo.php.bar
foo.php.en.anonymous

Thus, Protector inhibits such extensions in $_FILES[]['name']

Of course, all modules should ignore $_FILES[]['name'] if the file is placed under DocumentRoot.
And you can turn this off when all modules are free from such vulnerability.

However, when I read some major modules released from xoops.org some months ago, there are NO modules without the vulnerability...