CVE-2026-110777: Evolution-data-server: local file disclosure via attach file:// uris
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
evolution-data-serverto a version that resolves this vulnerability.Fixed in 3.62.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of evolution-data-server versions 3.26 through 3.62.0 who interact with events in a shared CalDAV calendar are exposed. The attacker must have access to that shared calendar.
What must an attacker do to exploit it?
An attacker needs to place a calendar event containing a file:// URI in its ATTACH property into a shared CalDAV calendar. When a user interacts with the malicious event and saves it, the client reads the referenced local file and uploads its base64-encoded contents to the server.
What data can be disclosed?
The issue can disclose arbitrary local files that the affected user is permitted to access. The description specifies no file-path restrictions or validation that the attachment originated from the server.
What is the remediation?
Upgrade evolution-data-server to version 3.62.1, which fixes the issue. Versions 3.26 through 3.62.0 are affected.