CVE-2006-0760: Lighttpd

Low severity, CVSS 2.6. EPSS: 2.2% chance of exploitation in the next 30 days.

LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names.

Affected products

• Lighttpd Lighttpd: version 1.0.2 only; version 1.0.3 only; version 1.1.0 only; version 1.1.1 only; version 1.1.2 only; version 1.1.3 only; …

Published 2006-02-18. Last modified 2026-06-16.