CVE-2013-1427: Lighttpd

Low severity, CVSS 1.9. EPSS: 0.3% chance of exploitation in the next 30 days.

The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.

Affected products

• Lighttpd Lighttpd: up to and including 1.4.27; version 1.3.16 only; version 1.4.3 only; version 1.4.4 only; version 1.4.5 only; version 1.4.6 only; …

Published 2013-03-21. Last modified 2026-06-16.