[原文]The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.
Lighttpd contains a flaw that may allow a malicious user to display the source code of arbitrary scripts instead of generated response. The issue is triggered when processing specially crafted HTTP requests containing %00 (null) character after the file extension. It is possible that the flaw may allow to bypass URL checks and obtain sensitive information resulting in a loss of confidentiality.
Upgrade to version 1.3.8 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.