Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0 as used in Apache CouchDB before 1.0.4 1.1.x before 1.1.2 and 1.2.x before 1.2.1 allows remote attackers to read arbitrary files via a ..\\ (dot dot backslash) in the default URI.