CVE-2006-1291

CVE-2006-1291 describes an authentication bypass vulnerability in publish.ical.php within Jim Hu and Chad Little PHP iCalendar versions 2.21 and earlier. This flaw allows unauthenticated remote attackers to upload and execute arbitrary PHP scripts by leveraging a WebDAV PUT request with a specially crafted filename containing a .php extension and a null character. With a CVSS score of 7.5, this vulnerability is considered highly severe due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While not listed on the CISA KEV catalog and with no evidence of widespread active exploitation or social media discussion, public exploit code is available via ExploitDB (EDB-1586), indicating a known method for exploitation.