Disable Parent Paths

[Robert Zachary <RZacha1@TANDY.COM>]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Writing a new IIS policy :

summary: Parent Paths allows you to use '..' in calls to MapPath and the
like. By default this option is enabled and should be disabled. To disable
this option go to the root of the Web site in question, right click select
Properties | Home Directory | Configuration | App Options and uncheck Enable
Parent Paths.

my question: What security hole/hack does this create if left enabled?.


Rob