CVE-2016-1505

Published: Feb 3, 2016Modified: May 6, 2026

10.0

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.8

Source: NVD

Description

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.

Affected (1)

Products: Radicale: Radicale

Radicale

1 product

Radicale

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Radicale Radicale	Up to 1.0.1

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

CWE-21

References (14)

http://www.openwall.com/lists/oss-security/2016/01/05/7

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/01/06/4

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/01/06/7

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/01/07/7

Source: cve@mitre.org

http://www.securityfocus.com/bid/80255

Source: cve@mitre.org

https://github.com/Kozea/Radicale/pull/343

Source: cve@mitre.org

Patch

https://github.com/Unrud/Radicale/commit/b4b3d51f33c7623d312f289252dd7bbb8f58bbe6

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/01/05/7