EIP-2026-103970

This is a detailed technical analysis of a vulnerability in Lighttpd (<1.4.23) caused by a filesystem bug in FreeBSD, OS X, and Solaris (<10) where trailing slashes on symlinks are silently dropped. This allows attackers to bypass suffix-based access controls (e.g., .php) and leak source code.