Larry Hastings proposed on the PSRT mailing list to add the following note of the SimpleHTTPServer documentation:

    Note: SimpleHTTPServer is, as its name implies, a simple HTTP
    server.  We provide it as a sample implementation of the Python HTTP
    server API.  However, SimpleHTTPServer is neither secure nor
    high-performance, and as such you should not use SimpleHTTPServer in
    security-sensitive or performance-sensitive applications.

For example, if you create a symbolic link outside the directory served by SimpleHTTPServer, SimpleHTTPServer follows symbolic links.