A new Debian Linux update has been published: DLA 2879-1: lighttpd security update
A lighttpd security update has been released for Debian GNU/Linux 9 LTS to address a potential ../ path traversal of a single directory above an alias target.Read more @ Linux Compatible