The issue is you haven't got Enable parent paths
enabled in the ASP application configuration.
Without it you are not permitted to use ..
directory traversing in ASP functions.
For more information see Enable Parent Paths Is Disabled by Default in IIS 6.0
On a side note:
I tend to avoid the need for Parent Paths simply by configuring websites as separate web site instances in IIS rather than using
%SystemDrive%\inetpub\wwwroot
which is where theDefault Website
instance resides. Doing this means that code likeServer.MapPath("/")
will be valid and point to the root of your site not theDefault Web Site
instance root.