Comment by BobVerg

A few quotes from the link, if you didn't read: "Some checks on a request URI were not executed on a character following an unescaped space character (which is invalid per HTTP protocol, but allowed for compatibility reasons since nginx 0.8.41)." [..] "by requesting a file as "/foo /../protected/file" (in case of static files, only if there is a "foo " directory with a trailing space)"