Thttpd 2.19 and below includes a CGI program "ssi" which contains a vulnerability which allows remote users to read any file on the webserver. Exploit examples included. Fix available here.
5cf4c016185b6b2c6b33bf5944ac239ead66ec315980d03e497f790eea3acb5b