CVE-2015-8747: The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbi...

Security readout for executives and security teams

CVE-2015-8747 affects Radicale before 1.1. A remote attacker could use a crafted component name against the multifilesystem storage backend to read or write arbitrary files. For organizations still running old Radicale deployments, the business concern is unauthorized access or modification of server files tied to calendar/contact infrastructure. Exposure is most likely in legacy Radicale installations below 1.1, especially where the multifilesystem storage backend is used and reachable by untrusted clients. Current exposure cannot be inferred from the bundle because affected package versions and deployment configurations are not enumerated. Treat this as a high-priority legacy exposure review, not an emergency active-exploitation event. Any reachable Radicale service below 1.1 should be upgraded or isolated because the documented impact includes arbitrary file read and write. Mitigation focus: Upgrade Radicale to version 1.1 or a vendor package containing the fix.; Check Debian and Fedora advisories if using distribution-managed Radicale packages.; Identify and prioritize internet-reachable Radicale services before internal-only deployments..

Prepared

Jun 13, 2026, 21:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.