There was some "reference" upnp implementation (I don't remember where it came from, but it was used in real products) where you could do http://<hostname>/getfile/$(echo ../../etc/passwd |base64) ... and get /etc/passwd.