Warpinator up to and including 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.
linuxmint warpinator