Encoded directory traversal vulnerability in Dino's web server 2.1 allows remote attackers to read arbitrary files via \..\ (dot dot) sequences with URL-encoded (1) \/\ (%2f\) or (2) \\\\ (%5c) characters.