VULNERABILITY INTELLIGENCE

CVE-2006-0760

CVSS score2.6 LOW
EPSS probability2.23%
CISA KEVNot currently listed
Published2006-02-18
Last modified2026-06-16
CVSS vectorAV:N/AC:H/Au:N/C:P/I:N/A:N

Description

LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names.

Primary references