CVE-2026-110777

MediumCVSS 5.7

Published: 14/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Summary

In evolution-data-server, calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally, allowing an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to.

Risk Assessment

An attacker with access to a shared CalDAV calendar can exfiltrate arbitrary files accessible to the user through malicious calendar events.

Recommendation

Update evolution-data-server to a fixed version and avoid opening untrusted calendar events from shared calendars.

Other vulnerabilities in evolution-data-server

CVE-2026-2604Medium
A flaw was found in evolution-data-server that allows for inconsistent comparison in the addressbook file backend. A Flatpak application with D-Bus access can craft a malicious URI containing directory traversal sequences, leading to the deletion of arbitrary files on the host filesystem.

Original NVD description (English source)

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS