CVE-2015-8747

Radicale vulnerable to arbitrary file read or write

10.0 CriticalFix available

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

2.97%Up 1.0 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

Record: CVE-2015-8747
CVSS 3.0: 10.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

Record: CVE-2015-8747
Updated: 2026-11-02

EUVDEUVD-2016-0029 No score

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

Record: EUVD-2016-0029
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fgqv-96v9-w23m 10.0

Radicale vulnerable to arbitrary file read or write

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

Record: GHSA-fgqv-96v9-w23m
CVSS 3.0: 10.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSV 10.0

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

Record: CVE-2015-8747
CVSS 3.0: 10.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-8747 10.0

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

Record: DEBIAN-CVE-2015-8747
CVSS 3.0: 10.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Updated: 2026-11-02

OSVGHSA-fgqv-96v9-w23m 10.0

Radicale vulnerable to arbitrary file read or write

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

Record: GHSA-fgqv-96v9-w23m
CVSS 3.0: 10.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-8747 10.0

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

Record: UBUNTU-CVE-2015-8747
CVSS 3.0: 10.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Updated: 2026-11-02

OSVPYSEC-2016-36 No score

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

Record: PYSEC-2016-36
Updated: 2026-11-02

Affected products

radicale

Affected packages

Affected packages
Package	Affected	Fixed
`radicale` PyPI	before 1.1	1.1
`radicale` Debian:12	before 1.1.1-1	1.1.1-1
`radicale` Debian:13	before 1.1.1-1	1.1.1-1
`radicale` Debian:14	before 1.1.1-1	1.1.1-1
`radicale` Debian:6.0	before 0.3-2+deb6u1, plus listed versions 0.3-2	0.3-2+deb6u1
`radicale` Debian:7	before 0.7-1.1+deb7u1, plus listed versions 0.7-1.1	0.7-1.1+deb7u1
`radicale` Debian:8	before 0.9-1+deb8u1, plus listed versions 0.9-1	0.9-1+deb8u1
`radicale` PyPI	before 1.1, plus listed versions 0.100.20.30.40.5 Show 13 moreShow less 0.60.6.10.6.20.6.30.6.40.70.7.10.80.90.9b10.9b21.01.0.1	1.1
`radicale` PyPI	before 1.1, plus listed versions 0.100.20.30.40.5 Show 14 moreShow less 0.60.6.10.6.20.6.30.6.40.70.7.10.80.90.9b10.9b21.01.0.10.1	1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-8747 is a critical vulnerability (CVSS 10.0) in Radicale, published January 26, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.97%, the 87th percentile. Fixed in radicale 1.1.

References

Show 13 moreShow less