Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using an HTTP request for colegal.htm that contains .. (dot dot) sequences.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2002-1697
http://www.securityfocus.com/bid/4084