WebCalendar is vulnerable to an information disclosure issue which allows an attacker to gain unauthorized read access to potentially sensitive information with the privileges of the web server process. This can be done by sending a specially crafted HTTP request to the vulnerable server, such as http://www.example.com/webcalendar/[filename].php?user_inc=../../../../../etc/passwd.