Description of problem: /usr/share/doc/cvsgraph-1.6.1/contrib/cvsgraph-httpd.conf is installed world-writable via the RPM. Version-Release number of selected component (if applicable): cvsgraph-1.6.1-1.fc5
Fixed in 1.6.1-2, thanks for the report.