CVE-2006-0760
LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote...
LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names.
Exploit likelihood
What each source reports
NVD Score used
LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names.
- Record
CVE-2006-0760- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names.
- Record
CVE-2006-0760- Updated
- 2026-11-02
EUVDEUVD-2006-0766 No score
LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names.
- Record
EUVD-2006-0766- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3mcq-rwcj-x5r6 No score
LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote...
LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names.
- Record
GHSA-3mcq-rwcj-x5r6- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-0760 is a low vulnerability (CVSS 2.6) in Lighttpd, published February 18, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.23%, the 82nd percentile. No source names a fixed version.