Overlooked one thing.

index.php

@@ -4,6 +4,7 @@
 
   // Prevent accessing stuff you're not supposed to access.
   $path = (isset($_GET["path"]) ? $_GET["path"] : "");
+  $path = htmlentities($path);
   if ($path == "/") $path = "";
   foreach (explode("/", $path) as $e) { if ($e == "." || $e == ".." || $e == ".git") die("fuck off."); }