It's possible to retrieve parent directory listing with /…%00 request.
vulners.com/securityvulns/securityvulns:doc:16047