CyberSec.Space Logo
Back to CVE Browser

CVE-2016-1505

CRITICAL
10.0
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile12.40th
PublishedFeb 3, 2016
Last ModifiedMay 6, 2026

Vulnerability Description

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.

Affected Platforms (CPE)

📦
Radicale

Radicale

<= 1.0.1

References & Advisories

🔗 http://www.openwall.com/lists/oss-security/2016/01/05/7
🔗 http://www.openwall.com/lists/oss-security/2016/01/06/4
🔗 http://www.openwall.com/lists/oss-security/2016/01/06/7
🔗 http://www.openwall.com/lists/oss-security/2016/01/07/7
🔗 http://www.securityfocus.com/bid/80255
🔗 https://github.com/Kozea/Radicale/pull/343
🔗 https://github.com/Unrud/Radicale/commit/b4b3d51f33c7623d312f289252dd7bbb8f58bbe6
🔗 http://www.openwall.com/lists/oss-security/2016/01/05/7

Related Vulnerabilities

CVE-2015-874710.0

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a craft...

CVE-2017-83428.1

Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd au...

CVE-2015-87485.3

Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in...

CVE-2016-134310.0

The XML parser in Cisco Information Server (CIS) 6.2 allows remote attackers to read arbitrary files or cause a denial of service ...