CVE-2026-110777
published 2026-10-14CVE-2026-110777: A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file…
PriorityP339medium5.7CVSS 3.1
AVNACLPRLUIRSUCHINAN
EPSS
0.39%
32.5th percentile
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnome | evolution-data-server | — | — |
| gnome | evolution-data-server | >= 3.26 < 3.62.1 | 3.62.1 |
CVSS provenance
nvdv3.15.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in evolution-data-server.
ghsa_unreviewed·2026-10-14
CVE-2026-110777 [MEDIUM] CWE-200 A flaw was found in evolution-data-server.
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.
Red Hat
evolution-data-server: local file disclosure via ATTACH file:// URIs
vendor_redhat·2026-10-08·CVSS 5.7
CVE-2026-110777 [MEDIUM] CWE-200 evolution-data-server: local file disclosure via ATTACH file:// URIs
evolution-data-server: local file disclosure via ATTACH file:// URIs
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload i
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-110777 evolution-data-server: local file disclosure via ATTACH file:// URIs [fedora-all]
bugzilla·2026-10-14·CVSS 5.7
CVE-2026-110777 [MEDIUM] CVE-2026-110777 evolution-data-server: local file disclosure via ATTACH file:// URIs [fedora-all]
CVE-2026-110777 evolution-data-server: local file disclosure via ATTACH file:// URIs [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user ha
Bugzilla
CVE-2026-110777 evolution-data-server: local file disclosure via ATTACH file:// URIs
bugzilla·2026-10-14·CVSS 5.7
CVE-2026-110777 [MEDIUM] CVE-2026-110777 evolution-data-server: local file disclosure via ATTACH file:// URIs
CVE-2026-110777 evolution-data-server: local file disclosure via ATTACH file:// URIs
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events. This vulnerability affects evolution-data-server versions 3.26 through 3.62.0 and is fixed in version 3.62.1.
2026-10-14
Published