CVE-2026-110777 in Red Hat
Summary
by MITRE • 10/15/2026
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in evolution-data-server represents a critical security flaw within the handling of Calendar Data Access Protocol (CalDAV) attachments, specifically targeting the ATTACH property structure used in iCalendar data objects. This issue stems from an insufficient validation mechanism when processing file references embedded within calendar events. When a user interacts with a shared CalDAV calendar that contains maliciously crafted event entries, the application automatically processes any URI present in the attachment field without performing adequate security checks. The core technical failure lies in the absence of path traversal restrictions and source verification protocols. Specifically, the software does not distinguish between attachments originally hosted on the remote server versus those added locally by the user or injected via a malicious calendar feed. This lack of differentiation allows an attacker to exploit the client's trust in the application's file handling capabilities to trigger unauthorized data access operations.
The operational impact of this vulnerability is severe, as it facilitates arbitrary local file exfiltration with minimal effort from the threat actor. By embedding a file:// URI pointing to sensitive system files or user-specific documents within an ATTACH property, an attacker can cause evolution-data-server to read the targeted local file directly from the filesystem. The application then base64-encodes the contents of this file and uploads them back to the CalDAV server where the malicious event resides. This process effectively turns the victim's calendar client into a data exfiltration tool, allowing sensitive information such as configuration files, private documents, or credentials stored in local directories to be transmitted over the network without explicit user consent for that specific action. The attack is particularly insidious because it occurs during routine interaction with shared calendars, potentially bypassing user awareness since the upload appears to be a standard synchronization operation rather than an active data transfer initiated by the user.
From a classification perspective, this vulnerability aligns closely with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials if sensitive files are targeted, though it is most accurately described under CWE-436 Interpretation Error or CWE-501 Trust Boundary Violation due to the failure to verify the source of the attachment data. In terms of adversarial tactics, this behavior maps directly to MITRE ATT&CK technique T1005 Data from Local System and potentially T1567 Exfiltration Over Web Service, as the attacker leverages a legitimate service (CalDAV) to smuggle out stolen data. The exploitation requires only that an attacker has access to create or modify events in a shared calendar visible to the victim, which is a common scenario in enterprise environments where team calendars are widely used for scheduling and coordination.
Mitigation strategies must focus on implementing strict input validation and enforcing security boundaries within the attachment processing logic. Developers should enforce allow-listing of permitted URI schemes, ensuring that only http:// or https:// protocols are accepted for remote attachments while explicitly blocking file:// URIs to prevent local filesystem access. Additionally, the application must implement source verification checks to distinguish between server-hosted resources and locally added files, refusing to process uploads originating from untrusted sources without explicit user confirmation. Network-level controls such as Data Loss Prevention (DLP) solutions can also help detect anomalous upload patterns associated with base64-encoded payloads being sent via CalDAV protocols. Until a patch is applied, users should exercise caution when subscribing to shared calendars from unknown or untrusted entities and consider disabling automatic attachment processing features if available in their client configuration settings.