Description
response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files.
Remediation
References
Related Vulnerabilities
WordPress Plugin Post Grid Gutenberg Blocks and WordPress Blog-PostX Security Bypass (4.1.2)
TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2025-59018)
phpBB Server-Side Request Forgery (SSRF) Vulnerability (CVE-2020-8226)
WordPress Plugin SEO Redirection-301 Redirect Manager Cross-Site Scripting (4.2)