Security issue with "Files" admin module

[bugman]

I've found, that user can access files and folder outside default "uploads" folder by just adding "../" to url like that:

http://sitename.com/admin/upload.php?path=../

This is kind of security hole for VDS hosting, when one has multiple websites owned by only user (usually [apache:apache] or [httpd:httpd]) and relies on application's logic handling web user permissions.