Have you tried to actually exploit that? I don't currently use Racket myself, but I would expect request-uri to prevent ".." and if it didn't surely url-path wo

Have you tried to actually exploit that? I don't currently use Racket myself, but I would expect request-uri to prevent ".." and if it didn't surely url-path would. ; extract the URI from the request: (define uri (request-uri req)) ; extract the resource from the URI: (define resource (map path/param-path (url-path uri))) ; find the file location: (define file (string-append document-root "/" (string-join resource "/")))