Hot of the press, Microsoft advises that you stick this :

void Application_BeginRequest(object source, EventArgs e) {
    if (Request.Path.IndexOf('\\') >= 0 ||
        System.IO.Path.GetFullPath(Request.PhysicalPath) != Request.PhysicalPath) {
        throw new HttpException(404, "not found");
    }
}

in your global.asax to avoid unautherized access to files via “canonicalization” - this is stuff like http://dotnet.org.za/../../../mysecretfile.doc etc.

check out the KB article