diff --git a/gpxe/gpxe-1.0.0-expandfilename.patch b/gpxe/gpxe-1.0.0-expandfilename.patch
new file mode 100644
index 0000000..b157e9c
--- /dev/null
+++ b/gpxe/gpxe-1.0.0-expandfilename.patch
@@ -0,0 +1,32 @@
+diff -urN gpxe-1.0.0/src/core/exec.c gpxe-1.0.0-expandfilename/src/core/exec.c
+--- gpxe-1.0.0/src/core/exec.c	2010-02-02 11:12:44.000000000 -0500
++++ gpxe-1.0.0-expandfilename/src/core/exec.c	2010-05-20 21:28:43.000000000 -0400
+@@ -94,7 +94,7 @@
+  * The expanded command line is allocated with malloc() and the caller
+  * must eventually free() it.
+  */
+-static char * expand_command ( const char *command ) {
++char * expand_command ( const char *command ) {
+ 	char *expcmd;
+ 	char *start;
+ 	char *end;
+diff -urN gpxe-1.0.0/src/usr/autoboot.c gpxe-1.0.0-expandfilename/src/usr/autoboot.c
+--- gpxe-1.0.0/src/usr/autoboot.c	2010-05-20 20:56:32.000000000 -0400
++++ gpxe-1.0.0-expandfilename/src/usr/autoboot.c	2010-05-20 21:31:49.000000000 -0400
+@@ -32,6 +32,7 @@
+ #include <usr/dhcpmgmt.h>
+ #include <usr/imgmgmt.h>
+ #include <usr/autoboot.h>
++char * expand_command ( const char *command );
+ 
+ /** @file
+  *
+@@ -85,6 +86,8 @@
+ 		uri_encode ( filename, buf + strlen ( buf ),
+ 			     sizeof ( buf ) - strlen ( buf ), URI_PATH );
+ 		filename = buf;
++	} else { /* only support variable expansion in absolute paths to avoid stepping on buf size */
++		filename = expand_command(filename);
+ 	}
+ 
+ 	image = alloc_image();
diff --git a/gpxe/xnba-kvm.spec b/gpxe/xnba-kvm.spec
index cf4836d..941c39a 100644
--- a/gpxe/xnba-kvm.spec
+++ b/gpxe/xnba-kvm.spec
@@ -1,6 +1,6 @@
 Name:           xnba-kvm
 Version:        1.0.0
-Release:        3
+Release:        4
 Summary:        xNBA loader for virtual guests
 Obsoletes:      etherboot-zroms-kvm
 Provides:      etherboot-zroms-kvm
@@ -31,6 +31,7 @@ Patch7: gpxe-0.9.7-undinet.patch
 Patch8: gpxe-1.0.0-int18boot.patch
 Patch9: gpxe-1.0.0-exittohd.patch
 Patch10: gpxe-1.0.0-cmdlinesize.patch
+Patch11: gpxe-1.0.0-expandfilename.patch
 
 %description
 The xNBA network bootloader provides network boot capability for virtual machines with e1000 and virtio network devices. This includes iSCSI and PXE with tftp or ftp image download capability.  It is a modified variant of gPXE
@@ -49,6 +50,7 @@ The xNBA network bootloader provides network boot capability for virtual machine
 %patch8 -p1
 %patch9 -p1
 %patch10 -p1
+%patch11 -p1
 
 %build
 
diff --git a/gpxe/xnba-undi.spec b/gpxe/xnba-undi.spec
index 8ebf26c..1ab1945 100644
--- a/gpxe/xnba-undi.spec
+++ b/gpxe/xnba-undi.spec
@@ -1,6 +1,6 @@
 Name:           xnba-undi
 Version:        1.0.0
-Release:        3
+Release:        4
 Summary:        xCAT Network Boot Agent for x86 PXE hosts
 Obsoletes:	gpxe-undi
 
@@ -25,6 +25,7 @@ Patch5: gpxe-1.0.0-hdboot.patch
 Patch6: gpxe-0.9.7-xnbauserclass.patch
 Patch7: gpxe-0.9.7-undinet.patch
 Patch8: gpxe-1.0.0-cmdlinesize.patch
+Patch9: gpxe-1.0.0-expandfilename.patch
 
 %description
 The xCAT Network Boot Agent is a slightly modified version of gPXE.  It provides enhanced boot features for any UNDI compliant x86 host.  This includes iSCSI, http/ftp downloads, and gPXE script based booting.
@@ -41,6 +42,7 @@ The xCAT Network Boot Agent is a slightly modified version of gPXE.  It provides
 %patch6 -p1
 %patch7 -p1
 %patch8 -p1
+%patch9 -p1
 
 %build