Directory Traversal

it could work if you encode characters