tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.
libslirp_project libslirp 4.1.0
qemu qemu 4.2.0