Volerion logoVolerion
Volerion logoVolerion

LuxCal Web Calendar Path Traversal Vulnerability in dloader.php

Vulnerability

A path traversal vulnerability has been identified in the LuxCal Web Calendar, specifically in versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). The vulnerability resides in the dloader.php script, allowing attackers to access arbitrary files on the server.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server.

Remediation

Users are advised to update LuxCal Web Calendar to version 5.3.3 or later. Instructions for downloading the latest version are available on the LuxCal website.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
3.4
impact
0.8
exploitability
7.6
remediation
7.7
relevance
0.0
threat
0.0
urgency
2.9
incentive
5.8

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.