The error.py controller uses paste.fileapp to serve the static
resources to the browser. The default error.py controller uses
os.path.join to combine the id from Routes with the media path.
Routes prior to 1.8 double unquoted the PATH_INFO, resulting in
FileApp returning files from the filesystem that can be outside
of the intended media path directory.
An attacker can craft URL's which utilize the double escaping
to pass in a name to the error.py controller which contains a
leading slash thus escaping the intended media path and serving
files from any location on the filesystem that the Pylons
application has access to.