Yaws webserver versions 1.55 and below suffer from a source code disclosure flaw when a null byte is appended to the filename being accessed.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/38182/yawsSource.txt
Source: https://packetstormsecurity.com/files/38182/yawsSource.txt.html