{"action":"Upgrade radicale to 1.1 or later.","affected":[{"fixed":"1.1","introduced":"0"}],"component":"radicale","cve_ids":["CVE-2015-8747"],"ecosystem":"PyPI","epss":0.03027,"exploited":false,"fixed_versions":["1.1"],"ghsa_id":"GHSA-fgqv-96v9-w23m","id":"tcs_01M5KG6XN2W5NTCR957AJQD5VM","modified_at":"2026-06-10T17:01:49.001986265Z","published_at":"2016-02-03T18:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2016-36","https://github.com/Unrud/Radicale/commit/bcaf452e516c02c9bed584a73736431c5e8831f1","http://www.debian.org/security/2016/dsa-3462","http://www.openwall.com/lists/oss-security/2016/01/05/7","http://www.openwall.com/lists/oss-security/2016/01/06/4","https://github.com/Kozea/Radicale/pull/343","http://www.openwall.com/lists/oss-security/2016/01/06/7","http://www.securityfocus.com/bid/80255","http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175776.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175738.html","https://pypi.org/project/radicale","https://nvd.nist.gov/vuln/detail/CVE-2015-8747","https://github.com/advisories/GHSA-fgqv-96v9-w23m"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"PYSEC-2016-36","url":"https://osv.dev/vulnerability/PYSEC-2016-36"},{"source":"nvd","source_id":"CVE-2015-8747","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8747"}],"summary":"The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name."}