EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a . (dot) which allows remote attackers to conduct directory traversal attacks cause a denial of service (heap-based buffer overflow and crash) or possibly execute arbitrary code via a crafted URI.