Hi Brain,
An early security technique implemented in NetTalk was to suppress requests which contain .., .exe, .pif and so on. Many worms etc try and execute code on the server (something NetTalk is more or less immune to anyway) by executing these sorts of programs.
You can override this check though in the WebHandler.
Go to the ValidateFileName method, and either just RETURN 0 before the parent call, or put in some checks of your own. See the netweb.clw file for what is currently in the method, and either adapt that in the WebHandler or as I say, override it completely.
In PR 39 I've commented out the EXE check because that one is largely obsolete now anyway.
Cheers
Bruce