Directory traversal vulnerability in Seagull Software Systems J Walk application server 3.2C9 and other versions before 3.3c4 allows remote attackers to read arbitrary files via a \.%252e\ (encoded dot dot) in the URL.