CVE-2008-1270

EPSS 8.8%

lighttpd - arbitrary file disclosure

Published: 3/10/2008Modified: 4/28/2026

Description

mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.

Affected packages (2)

Debian/lighttpdfrom 0, < 1.4.19-1
Debian/lighttpdfrom 0, < 1.4.13-4etch6

References (1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2008-1270