CVE-2005-3366: PHP file inclusion vulnerability in index.php in PHP iCalendar 2.0a2 through 2.0.1 allows remote attackers...

Security readout for executives and security teams

This is an old PHP iCalendar issue where a crafted cookie can make the application include files it should not. In the worst case, that can lead to PHP code execution on the web server. It matters mainly where legacy PHP iCalendar 2.0a2 through 2.0.1 is still reachable. Exposure is likely limited to legacy PHP iCalendar deployments, especially internet-facing instances running versions 2.0a2 through 2.0.1. The source bundle does not provide CPEs, package identifiers, or a confirmed fixed version. Treat this as high priority only if PHP iCalendar is still deployed. The vulnerability can affect server confidentiality and integrity, but the affected software is old and may not exist in modern environments. Fast inventory is the key decision point. Mitigation focus: Inventory and retire any exposed PHP iCalendar 2.0a2 through 2.0.1 deployments.; Check vendor or project guidance for a confirmed fixed release before upgrading.; Restrict public access to affected index.php endpoints where immediate removal is not possible..

Prepared

Jun 29, 2026, 17:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.