it's quite simple to get rid of that bug.
I just did a search on the text 'you are not allowed etc.' in Dreamweaver and found a bunch of files in the imageflow plugin that uses that text.
But the one that is important is the one in plugins/nextgen-imageflow/lib/core.php
Just uncomment the first line of that file by adding // after the <?php.
So the line will look like this:
<?php //if(preg_match('#' . basename(__FILE__) . '#', $_SERVER['PHP_SELF'])) { die('You are not allowed to call this page directly.'); }
After that you can reach the update-core file again.
I never used this plugin before and normally I won't use any plugins that are so buggy (because this is not the only bug I found) but I haven't found any other plugin that does the same imageflow so I give it a shot anyway.