CVE-2026-110777

Name	CVE-2026-110777
Description	A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
evolution-data-server (PTS)	bookworm	3.46.4-2	vulnerable
	bookworm (security)	3.46.4-2+deb12u1	vulnerable
	trixie	3.56.2-0+deb13u1	vulnerable
	forky, sid	3.56.2-9	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
evolution-data-server	source	(unstable)	(unfixed)

Notes

https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/672
https://gitlab.gnome.org/GNOME/evolution-data-server/-/merge_requests/262
Fixed by: https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/3d6d491ea5ce11ccb8ba73be4c03573ccf0858fa