Description
PHP remote file inclusion vulnerability in WebCalendar before 1.0.1 allows remote attackers to execute arbitrary PHP code when opening settings.php, possibly via send_reminders.php or other scripts.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | webcalendar | 0.9.45-4sarge2 | DSA-799-1 |
Advisories 1
- DSA-799-1 webcalendar - input validation Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2005-1513 vdb-entry
- 16675 third-party-advisory
- 1014849 vdb-entry
- webcalendar-includedir-file-include(22136) vdb-entry
- DSA-799 vendor-advisory
- 14651 vdb-entry
- 16528 third-party-advisory
- http://sourceforge.net/project/shownotes.php?release_id=350336