CVE-2015-8747: Radicale - Arbitrary File Read/Write Vulnerability
Summary
CVE-2015-8747: The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name. Affects radicale across 2 version ranges.
< 1.1
< bcaf452e516c02c9bed584a73736431c5e8831f1
Fixed in bcaf452e516c02c9bed584a73736431c5e8831f1. How to fix ↓
Also tracked for
- radicale · Debian:11
The same CVE-2015-8747 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Radicale is an open-source CalDAV and CardDAV server written in Python. It provides a simple and lightweight solution for hosting calendars and address books. The multifilesystem storage backend in Radicale versions prior to 1.1 is vulnerable to an arbitrary file read/write attack. This vulnerability allows remote attackers to access or modify arbitrary files by exploiting a flaw in the component name handling.
Vulnerability Detail
The vulnerability in Radicale arises from improper handling of component names. Remote attackers can exploit this flaw to read or write to arbitrary files on the server. By crafting a malicious component name, an attacker can bypass access restrictions and gain unauthorized access to sensitive files. This can lead to the exposure of sensitive information or the modification of critical system files, potentially resulting in a compromise of the server's integrity and confidentiality.
How To Fix
Latest published version: 3.8.3 as of 23 Oct 2026
pip install --upgrade "radicale==3.8.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
bcaf452e516c02c9bed584a73736431c5e8831f1
This is the first release that contains the fix.
pip install --upgrade "radicale==bcaf452e516c02c9bed584a73736431c5e8831f1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Radicale to the latest version to mitigate the risk of exploitation.
Conclusion
The vulnerability in Radicale versions prior to 1.1 allows remote attackers to read or write to arbitrary files on the server. To mitigate this risk, it is crucial to update Radicale to the latest version. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for radicale →
FAQ
Radicale is an open-source CalDAV and CardDAV server written in Python. It allows users to host their calendars and address books.
The vulnerability allows remote attackers to read or write to arbitrary files on the server, potentially leading to unauthorized access to sensitive information or the modification of critical system files.
To fix this vulnerability, update Radicale to version 1.1 or later. The fix can be found in the commit bcaf452e516c02c9bed584a73736431c5e8831f1 on the official GitHub repository.
No, there is no known workaround for this vulnerability. It is crucial to update Radicale to the latest version to mitigate the risk.
For more information about this vulnerability, you can refer to the official advisory database entry at https://github.com/pypa/advisory-database/blob/main/vulns/radicale/PYSEC-2016-36.yaml
Related vulnerabilities
Recent vulnerabilities recorded for radicale.
