Yeah, good catch. This thing is an open http server for the entire file system. Thankfully it doesn't support POST or PUT. 

There's no reason we should allow the root-dir to be specified as a request parameter. That's insane. I pity the fool running this as root.

Whatever the fix, I think it needs to be a high priority. I would also consider back porting the fix to earlier releases.