Description
PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter, which is remotely accessed in an fopen call whose results are used to define a user_inc setting that is used in an include_once call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | webcalendar | 0.9.45-4sarge5 | DSA-1096-1 |
Advisories 1
- DSA-1096-1 webcalendar - uninitialised variable Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1016179 vdb-entry
- 20542 third-party-advisory
- 18175 vdb-entry
- DSA-1096 vendor-advisory
- 20060607 Re: WebCalendar-1.0.3 reading of any files mailing-list
- 25842 vdb-entry
- 20367 third-party-advisory
- ADV-2006-2067 vdb-entry
- 20060530 WebCalendar-1.0.3 reading of any files mailing-list
- 1019 third-party-advisory