diff --git a/snap-core.cabal b/snap-core.cabal
--- a/snap-core.cabal
+++ b/snap-core.cabal
@@ -1,5 +1,5 @@
 name:           snap-core
-version:        0.2.15.1
+version:        0.2.16
 synopsis:       Snap: A Haskell Web Framework (Core)
 
 description:
diff --git a/src/Snap/Iteratee.hs b/src/Snap/Iteratee.hs
--- a/src/Snap/Iteratee.hs
+++ b/src/Snap/Iteratee.hs
@@ -442,14 +442,10 @@
                  -> IO (Iteratee IO a)
 _enumFilePartial fp (start,end) iter = do
     let len = end - start
-
-    h  <- liftIO $ openBinaryFile fp ReadMode
-    unless (start == 0) $
-           hSeek h AbsoluteSeek $ toInteger start
-
-    let i' = joinI $ takeExactly len iter
-
-    enumHandle h i' `finally` hClose h
+    withBinaryFile fp ReadMode
+      (\h -> do
+        unless (start == 0) $ hSeek h AbsoluteSeek $ toInteger start
+        enumHandle h $ joinI $ takeExactly len iter)
 
 
 enumFile :: FilePath -> Iteratee IO a -> IO (Iteratee IO a)
diff --git a/src/Snap/Util/FileServe.hs b/src/Snap/Util/FileServe.hs
--- a/src/Snap/Util/FileServe.hs
+++ b/src/Snap/Util/FileServe.hs
@@ -172,10 +172,14 @@
     req <- getRequest
     let p = S.unpack $ rqPathInfo req
 
+    -- relative paths only!
+    when (not $ isRelative p) pass
+
     -- check that we don't have any sneaky .. paths
     let dirs = splitDirectories p
     when (elem ".." dirs) pass
-    return p
+
+    return $ joinPath dirs
 
 
 ------------------------------------------------------------------------------