Absolute path traversal vulnerability in Quake II server before R1Q2 on Windows as used in multiple products allows remote attackers to read arbitrary files via a \\\/\ in a pathname argument as demonstrated by \download \\/server.cfg\.