CVE-2015-8747: Radicale vulnerable to arbitrary file… – CVSS 10.0 · Watchpost

← All vulnerabilities

Radicale vulnerable to arbitrary file read or write

CRITICAL 10.0CVE-2015-8747 · GHSA-fgqv-96v9-w23m · PYSEC-2016-36 · Published 03/02/2016 · updated 17/06/2026

In short

CVE-2015-8747 is a CRITICAL (CVSS 10.0) vulnerability affecting radicale, radicale (radicale).
Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.3% of all vulnerabilities.
Fix: update to 1.1 or later.

Package	Affected versions	Patched versions
radicale PyPI	`< 1.1`	`1.1`
radicale radicale	`≤ 1.0.1`	No fix yet

Description

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

NVD description

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

References

nvd.nist.gov/vuln/detail/CVE-2015-8747 · ADVISORY
Kozea/Radicale#343 · WEB
Kozea/Radicale commit 18c8864 · WEB
Unrud/Radicale commit bcaf452 · WEB
Kozea/Radicale · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20200804235922/http://www.securityfocus.com/bid/80255 · WEB
lists.fedoraproject.org/pipermail/package-announce/2016-January/175738.html · WEB
lists.fedoraproject.org/pipermail/package-announce/2016-January/175776.html · WEB
debian.org/security/2016/dsa-3462 · WEB
openwall.com/lists/oss-security/2016/01/05/7 · WEB
openwall.com/lists/oss-security/2016/01/06/4 · WEB
openwall.com/lists/oss-security/2016/01/06/7 · WEB
securityfocus.com/bid/80255
pypi.org/project/radicale · PACKAGE
GitHub Advisory GHSA-fgqv-96v9-w23m · ADVISORY

More vulnerabilities in radicale

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free