interesting

isn't server.cfg vulnerable too?