CVE-2008-1270

mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.

Date published : 2008-03-10

http://www.securityfocus.com/bid/28226

http://www.securityfocus.com/archive/1/489465/100/0/threaded