Description
mod_userdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons on filename components in configuration options, which might allow remote attackers to bypass intended access restrictions, as demonstrated by a request for a .PHP file when there is a configuration rule for .php files.
Remediation
References
Related Vulnerabilities
Oracle Database Server Other Vulnerability (CVE-2005-0297)
WordPress 5.0.x Multiple Vulnerabilities (5.0 - 5.0.9)
MySQL CVE-2021-2088 Vulnerability (CVE-2021-2088)
WordPress Plugin MAC PHOTO GALLERY Arbitrary File Download (3.0)
ClipBucket Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2018-7665)