Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component

Also known as GHSA-84cw-mxhv-qvv4, PYSEC-2026-512

Published 10 y ago 2016-02-03 · modified 4 mo ago 2026-07-01 · JSON

CVSS

10.0

v3.0 · NVD

CISA KEV

not known exploited

EPSS

2.6%

percentile 85%

Public exploits

none known

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.

Exploit prediction (EPSS)

2.61% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	10.0	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`
GitHub	3.0	10.0	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`
OSV	3.0	10.0	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
pypi	`radicale`	<1.1	1.1

Classification

Weakness

CWE-21 DEPRECATED: Pathname Traversal and Equivalence Errors
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

openwall.com /lists/oss-security/2016/01/06/7 · mailing-list, x_refsource_MLIST, x_transferred
securityfocus.com /bid/80255 · vdb-entry, x_refsource_BID, x_transferred
github.com /Unrud/Radicale/commit/b4b3d51f33c7623d312f289252dd7bbb8f58bbe6 · x_refsource_CONFIRM, x_transferred
openwall.com /lists/oss-security/2016/01/05/7 · mailing-list, x_refsource_MLIST, x_transferred
github.com /Kozea/Radicale/pull/343 · x_refsource_CONFIRM, x_transferred
openwall.com /lists/oss-security/2016/01/06/4 · mailing-list, x_refsource_MLIST, x_transferred
openwall.com /lists/oss-security/2016/01/07/7 · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-1505 · advisory
github.com /Kozea/Radicale/commit/b4b3d51f33c7623d312f289252dd7bbb8f58bbe6 · web
github.com /Kozea/Radicale · package
pypi.org /project/radicale · package
github.com /advisories/GHSA-84cw-mxhv-qvv4 · advisory

Sources

CVE List: CVE-2016-1505
GitHub Advisory: GHSA-84cw-mxhv-qvv4
NVD: CVE-2016-1505
OSV: PYSEC-2026-512

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.