static_compressed_inmemory_website_callback.c in Glewlwyd up to and including 2.6.2 allows directory traversal.
glewlwyd project glewlwyd