CVE-2006-1291: publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication f...

Security readout for executives and security teams

PHP iCalendar 2.21 and earlier could let an unauthenticated internet attacker place a PHP file where the web server may run it. That can turn a calendar-publishing feature into remote code execution if the vulnerable file is exposed and the calendars directory executes PHP. Exposure is most likely on public PHP iCalendar 2.21 or earlier deployments with publish.ical.php reachable and calendar storage writable by the web server. Risk increases when uploaded files in the calendars directory can be executed as PHP. Treat as urgent for any remaining legacy PHP iCalendar deployment. The business risk is full server compromise through an unauthenticated web path. If the product is not present or not internet-facing, priority drops after verification. Mitigation focus: Identify and retire or upgrade PHP iCalendar 2.21 and earlier deployments.; Check maintainer or vendor guidance for any fixed release or supported migration path.; Disable or restrict publish.ical.php if WebDAV publishing is not required..

Prepared

Jun 29, 2026, 13:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.