Vulnerability · Published Oct 14, 2026 · Assigned by redhat
CVE-2026-110777Evolution-data-server: local file disclosure via attach file:// uris
Medium 5.7
In plain English
A medium-severity information exposure in evolution-data-server from GNOME. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | evolution-data-server | no fix listed | DEBIAN-CVE-2026-110777 |
| Debian:13 | evolution-data-server | no fix listed | DEBIAN-CVE-2026-110777 |
| Debian:14 | evolution-data-server | no fix listed | DEBIAN-CVE-2026-110777 |
| Ubuntu:22.04:LTS | evolution-data-server | no fix listed | UBUNTU-CVE-2026-110777 |
| Ubuntu:24.04:LTS | evolution-data-server | no fix listed | UBUNTU-CVE-2026-110777 |
| Ubuntu:26.04:LTS | evolution-data-server | no fix listed | UBUNTU-CVE-2026-110777 |
| Ubuntu:26.10 | evolution-data-server | no fix listed | UBUNTU-CVE-2026-110777 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GNOME | evolution-data-server | 3.26 – before 3.62.1 |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
References
- https://access.redhat.com/security/cve/CVE-2026-110777 vdb-entry, x_refsource_REDHAT
- RHBZ#2552693 issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/672