@GossiTheDog I don't know about every implementation but Apache, as it ships from Debian at least, disables directory traversal out of the web directory by default.