GitHub Advisoryadvisory · PyPI

GHSA-84cw-mxhv-qvv4 Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component

CRITICAL Published 2022-05-17 Modified 2023-08-02 Official page ↗
Aliases
CVE-2016-1505
Ecosystem
PyPI
Packages
Radicale
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-22
Reviewed
2023-08-02

Affected packages

• PyPI Radicale: < 1.1 → fixed in 1.1

Description

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.

Related

Alias · CVE (1)

  • CVE-2016-1505 The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References