webmin/webmin — pull request #28 by Neo139 (2011-10-22 02:35:50+00:00)
Title: Escaping filename.

Nice example of something that can be exploited if referer protection is disabled.