The default configuration for twiki 4.1.2 on Debian GNU/Linux and possibly other operating systems specifies the work area directory (cfg{RCS}{WorkAreaDir}) under the web document root which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied.