CVE-2015-8748: Radicale Regex Metacharacters Injection in User Name
Summary
CVE-2015-8748: Radicale regex metacharacters injection in the user name. Affects radicale versions < 1.1. Fixed in 1.1. How to fix ↓
Also tracked for
- radicale · Debian:11
The same CVE-2015-8748 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Radicale is an open-source CalDAV and CardDAV server written in Python. It allows users to synchronize and share calendars and contacts across multiple devices. The vulnerability in question affects Radicale versions prior to 1.1. It allows remote authenticated users to bypass owner_write and owner_only limitations by exploiting regex metacharacters in the user name field. This vulnerability was assigned the CVE identifier CVE-2015-8748 and has a CVSS score of 5.3 (Moderate).
Vulnerability Detail
The vulnerability arises from a lack of proper input validation in the user name field. By using regex metacharacters, such as '.*', an attacker can manipulate the regular expression used to match user names. This allows them to bypass restrictions set by the owner_write and owner_only settings, granting them unauthorized access to resources. The impact of this vulnerability depends on the specific permissions and restrictions in place for the affected Radicale instance.
How To Fix
Latest published version: 3.8.3 as of 23 Oct 2026
pip install --upgrade "radicale==3.8.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1
This is the first release that contains the fix.
pip install --upgrade "radicale==1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually sanitize the user name inputs to remove any potential regex metacharacters. This can be done by implementing input validation and sanitization routines in the application code that handles user registration and authentication. Here is an example in Python:
import re
def sanitize_username(username):
return re.sub(r'[.*]', '', username)
Conclusion
In conclusion, the Radicale CalDAV and CardDAV server prior to version 1.1 is vulnerable to a regex metacharacters injection issue in the user name field. This vulnerability allows remote authenticated users to bypass owner_write and owner_only limitations. To mitigate this vulnerability, users should upgrade their Radicale installation to version 1.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for radicale →
FAQ
Radicale is an open-source CalDAV and CardDAV server that allows users to synchronize and share calendars and contacts across multiple devices.
Radicale versions prior to 1.1 are affected by this vulnerability.
An attacker with remote authenticated access can manipulate the user name field using regex metacharacters to bypass owner_write and owner_only limitations, gaining unauthorized access to resources.
The CVSS score of this vulnerability is 5.3 (Moderate).
To fix this vulnerability, upgrade your Radicale installation to version 1.1 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for radicale.
