CVE-2026-110777

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110777
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110777.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110777
Downstream
Published
2026-10-14T18:08:36Z
Modified
2026-10-16T02:47:59Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Evolution-data-server: local file disclosure via attach file:// uris
Details

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110777.json"
}
References

Affected packages

Git / gitlab.gnome.org/gnome/evolution-data-server

Affected ranges

Type
GIT
Repo
https://gitlab.gnome.org/gnome/evolution-data-server
Events
Introduced
7e33c66b1e0c6d7763357262d414a3db5160a485
Fixed
757672184698ec9f46cc16cf8860ec312d1e9d36
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "3.26"
        },
        {
            "fixed":  "3.62.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

3.*
3.27.4
3.27.90
3.27.91
3.27.92
3.28.0
3.29.1
3.29.2
3.29.3
3.29.4
3.29.90
3.29.91
3.29.92
3.30.0
3.31.1
3.31.2
3.31.3
3.31.4
3.31.90
3.31.91
3.31.92
3.32.0
3.33.1
3.33.2
3.33.3
3.33.4
3.33.90
3.33.91
3.33.92
3.34.0
3.35.1
3.35.2
3.35.3
3.35.90
3.35.91
3.35.92
3.36.0
3.37.1
3.37.2
3.37.3
3.37.90
3.37.92
3.38.0
3.39.1
3.39.2
3.39.3
3.40.0
3.41.1
3.41.2
3.41.3
3.42.0
3.43.1
3.43.1.1
3.43.2
3.43.3
3.44.0
3.45.1
3.45.2
3.45.3
3.46.0
3.47.1
3.47.2
3.47.3
3.48.0
3.49.1
3.49.2
3.49.3
3.50.0
3.51.1
3.51.2
3.51.3
3.52.0
3.53.1
3.53.2
3.53.3
3.54.0
3.55.1
3.55.2
3.55.3
3.56.0
3.57.1
3.57.2
3.57.3
3.58.0
3.59.1
3.59.2
3.59.3
3.60.0
3.61.1
3.61.2
3.61.3
3.62.0
Other
EVOLUTION_DATA_SERVER_3_26_0
EVOLUTION_DATA_SERVER_3_27_1
EVOLUTION_DATA_SERVER_3_27_2
EVOLUTION_DATA_SERVER_3_27_3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110777.json"