The title makes it look like the problem comes with the "~username" URLS naming scheme, while it really comes from any features that let the user host static fi

The title makes it look like the problem comes with the "~username" URLS naming scheme, while it really comes from any features that let the user host static files they upload AND link somewhere else on your website. The site take the example of apache mod_sites, but alone it's not enough. You need apache mod_sites, and the ability inject a link served by it somewhere else. Well, yes. If you let user input anything and then inject it anywhere in your website, it's a security whole. Not a surprised. So if you let your users host entire application on your website, and let other users of your website visit those applications. Well, I mean, sure it's a problem. The best sandbox is the one you don't need to use.