Ada Image Server (ImgSvr) 0.4 allows remote attackers to view directories or download files via an HTTP request with a trailing %00 (null).
https://exchange.xforce.ibmcloud.com/vulnerabilities/15706
http://sourceforge.net/project/shownotes.php?release_id=230023