Description
mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to bypass url.access-deny settings.
Remediation
References
Related Vulnerabilities
SharePoint Stack-based Buffer Overflow Vulnerability (CVE-2026-55134)
WordPress Plugin Poll Maker Cross-Site Scripting (3.2.8)
MediaWiki Observable Differences in Behavior to Error Inputs Vulnerability (CVE-2020-35624)
Craft CMS Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-33158)
WordPress Plugin WordPress Photo Gallery by Gallery Bank Unspecified Vulnerability (4.0.48)