The KF Web Server v1.0.2 shows file and directory content if %00 is appended to the URL. Patch available here.