Acme mini_httpd before 1.16 allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request with a trailing /.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2001-0876
http://www.iss.net/security_center/static/7541.php