Not saying there isn't an exploit here, but that's not it. % foo="& do_evil" % cat "$foo" cat: & do_evil: No such file or directory Now if the req

Not saying there isn't an exploit here, but that's not it. % foo="& do_evil" % cat "$foo" cat: & do_evil: No such file or directory Now if the request was for the path /../../../../../../etc/passwd ... that's a different story. edit: and with the CGI stuff it might be possible to execute rm or something else dangerous/destructive.