Arbitrary file read via normalized traversal paths

Path traversal in all versions of xudafeng startserver allows remote attackers to read files outside the served directory via crafted HTTP paths. The static-file middleware decodes the request pathname, joins it to the process working directory, normalizes the result, and reads any resulting file without checking that it remains beneath the server root. No authentication or user interaction is required; disclosure is limited to files readable by the server process.