File Exfiltration Vulnerability in Evolution Data Server by Red Hat

CVE-2026-110777

What is CVE-2026-110777?

A vulnerability exists in the Evolution Data Server where calendar events can include a file:// URI in their ATTACH property, leading to potential file exfiltration. When a user saves such an event, the server automatically reads the targeted local file, base64-encodes its contents, and uploads it back to the server. This process occurs without any file path restrictions or checks to confirm the source of the attachment, posing a risk that an attacker with access to a shared CalDAV calendar can exfiltrate any accessible file from the user's system via malicious calendar events.

References