TCLHttpd version 3.4.2 is susceptible to arbitrary directory browsing when an absolute path is entered against Dirlist.tcl even though it does prevent and filter basic URL attacks. This release also suffers from multiple cross site scripting vulnerabilities.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/31699/TCLHttpd.txt
Source: https://packetstormsecurity.com/files/31699/TCLHttpd.txt.html