CVE-2006-0814: Lighttpd

Medium severity, CVSS 5.0. EPSS: 10.6% chance of exploitation in the next 30 days.

response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files.

Affected products

• Lighttpd Lighttpd: version 1.0.2 only; version 1.0.3 only; version 1.1.0 only; version 1.1.1 only; version 1.1.2 only; version 1.1.3 only; …

Published 2006-03-06. Last modified 2026-06-16.