CRITICAL10.0

PYSEC-2026-512

Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component

Quick fix

PYSEC-2026-512 — radicale: upgrade to the fixed version with the command below.

pip install --upgrade 'radicale>=1.1'

Details

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/radicale

Introduced in: 0Fixed in: 1.1

Fixpip install --upgrade 'radicale>=1.1'

References

https://nvd.nist.gov/vuln/detail/CVE-2016-1505[ADVISORY]
https://github.com/Kozea/Radicale/pull/343[WEB]
https://github.com/Kozea/Radicale/commit/b4b3d51f33c7623d312f289252dd7bbb8f58bbe6[WEB]
https://github.com/Kozea/Radicale[PACKAGE]
http://www.openwall.com/lists/oss-security/2016/01/05/7[WEB]
http://www.openwall.com/lists/oss-security/2016/01/06/4[WEB]
http://www.openwall.com/lists/oss-security/2016/01/06/7[WEB]
http://www.openwall.com/lists/oss-security/2016/01/07/7[WEB]
http://www.securityfocus.com/bid/80255[WEB]
https://pypi.org/project/radicale[PACKAGE]
https://github.com/advisories/GHSA-84cw-mxhv-qvv4[ADVISORY]