I feed it the directory via the URL and It works

Are you sure? Do you validate the directory path passed in via the URL? Without more info, this sounds awfully like a potential directory traversal exploit to me.