BadBlue 302 Status Message XSS

BadBlue 1.74 presumably earlier is susceptible to a cross-site scripting attack. When BadBlue is passed a name of a non-existant file path or an existant folder that does not end in a 0x2f character "/" it returns a 302 status code containing some text: HTTP/1.0 302 found Location: /SCRIPT/...