While trying to replicate a security vulnerability on my local machine I realized that PHP on my machine does not decode
%2e as a dot. I created the following test-file:
Which always returns false. What are the server requirements that an attack like this would work?
I'm running Apache/2.4.18 with PHP 7.0.25-0ubuntu0.16.04.1.