| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| WebCalendar-1.9.25.zip.pem | 2026-10-05 | 3.4 kB | |
| WebCalendar-1.9.25.zip.sig | 2026-10-05 | 96 Bytes | |
| MANIFEST.sha256 | 2026-10-05 | 168.4 kB | |
| MANIFEST.sha256.sig | 2026-10-05 | 89 Bytes | |
| WebCalendar-1.9.25.zip | 2026-10-05 | 6.8 MB | |
| README.md | 2026-10-05 | 2.3 kB | |
| WebCalendar v1.9.25 source code.tar.gz | 2026-10-05 | 6.2 MB | |
| WebCalendar v1.9.25 source code.zip | 2026-10-05 | 7.4 MB | |
| Totals: 8 Items | 20.5 MB | 1 | |
WebCalendar v1.9.25.
This is a security release. It fixes an unauthenticated file inclusion in
js_cacher.php and a reflected cross-site scripting issue in the category
picker and availability view. All installations should upgrade. It also
makes the MCP server work in release zips and Docker images for the first
time. There are no database changes.
Security
Unauthenticated file inclusion in js_cacher.php. The inc parameter
was checked only for a leading js/, and .. was not filtered, so a request
such as js_cacher.php?inc=js/../../../../../etc/passwd returned any file the
web server could read. PHP files elsewhere on the server could be executed in
WebCalendar's context in the same way. No login was required. Only files
directly inside includes/js/ can be included now. Reported by
dutchypoo.
Reflected XSS in catsel.php and availability.php. Request values
(the form name, and the availability view's date) were written unescaped into
a <script src> attribute and into the JavaScript served for it, so a crafted
link could run script in a logged-in user's session. The values are now
URL-encoded in the attribute and restricted to integers or plain identifiers
in the script.
Fixed
- The MCP server was unavailable in every release zip and Docker image,
because neither shipped the MCP SDK. The SDK and its runtime dependencies
now ship in
includes/classes/mcp-sdk/(#796, [#797]). - The documented Docker quick start failed on a fresh clone.
docker/docker-compose-prod.ymlnow builds the image instead of trying to pull one that does not exist (#793). includes/zone.tabshipped with CRLF line endings, so the Security Audit reported it as modified on installations where nothing had been modified (#788).docs/mcp-server.mddescribed token setup that no longer exists, and three documents still gave PHP 8.0 as the minimum, rather than 8.2 (#793).
Changed
- The Security Audit now says when a file differs only in line endings, and says that no action is needed, instead of advising a restore from the release zip.
See CHANGELOG.md for full details.
Verifying this release
WebCalendar releases ship a signed manifest. See docs/release-signing.md for
verification instructions.
