flores/moarcats — pull request #19 by matt- (2013-06-25 02:35:41+00:00)
Title: Unsafe file path handling can lead to bad things. 

fs.readFile is passed a filename that comes from user params. A user can send a relative file path with the file name to the app for example:

GET /netcat/..%2Fserver.js