{"id":"UBUNTU-CVE-2026-110777","details":"A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.","modified":"2026-10-17T12:59:51.701678376Z","published":"2026-10-15T00:00:00Z","upstream":["CVE-2026-110777"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-110777"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-110777"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-110777"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552693"},{"type":"REPORT","url":"https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/672"}],"affected":[{"package":{"name":"evolution-data-server","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/evolution-data-server?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.5-1ubuntu3","3.18.1-1ubuntu1","3.18.2-0ubuntu1","3.18.2-0ubuntu2","3.18.3-1ubuntu1","3.18.3-1ubuntu2","3.18.4-0ubuntu1","3.18.5-1ubuntu1","3.18.5-1ubuntu1.1","3.18.5-1ubuntu1.2","3.18.5-1ubuntu1.3"],"ecosystem_specific":{"binaries":[{"binary_name":"evolution-data-server","binary_version":"3.18.5-1ubuntu1.3"},{"binary_version":"3.18.5-1ubuntu1.3","binary_name":"evolution-data-server-common"},{"binary_name":"evolution-data-server-online-accounts","binary_version":"3.18.5-1ubuntu1.3"},{"binary_name":"gir1.2-ebook-1.2","binary_version":"3.18.5-1ubuntu1.3"},{"binary_name":"gir1.2-ebookcontacts-1.2","binary_version":"3.18.5-1ubuntu1.3"},{"binary_version":"3.18.5-1ubuntu1.3","binary_name":"gir1.2-edataserver-1.2"},{"binary_name":"libcamel-1.2-54","binary_version":"3.18.5-1ubuntu1.3"},{"binary_name":"libebackend-1.2-10","binary_version":"3.18.5-1ubuntu1.3"},{"binary_version":"3.18.5-1ubuntu1.3","binary_name":"libebook-1.2-16"},{"binary_name":"libebook-contacts-1.2-2","binary_version":"3.18.5-1ubuntu1.3"},{"binary_version":"3.18.5-1ubuntu1.3","binary_name":"libecal-1.2-19"},{"binary_version":"3.18.5-1ubuntu1.3","binary_name":"libedata-book-1.2-25"},{"binary_version":"3.18.5-1ubuntu1.3","binary_name":"libedata-cal-1.2-28"},{"binary_name":"libedataserver-1.2-21","binary_version":"3.18.5-1ubuntu1.3"},{"binary_version":"3.18.5-1ubuntu1.3","binary_name":"libedataserverui-1.2-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110777.json"}},{"package":{"name":"evolution-data-server","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/evolution-data-server?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.1-1ubuntu1","3.26.2-1ubuntu1","3.26.2.1-1ubuntu1","3.26.2.1-1ubuntu3","3.26.3-1ubuntu1","3.26.5-1ubuntu3","3.27.90-1ubuntu1","3.28.0-1ubuntu1","3.28.0-2ubuntu1","3.28.0-2ubuntu2","3.28.1-1ubuntu1","3.28.3-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.2","3.28.5-0ubuntu0.18.04.3","3.28.5-0ubuntu0.18.04.3+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"evolution-data-server","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"evolution-data-server-common","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_version":"3.28.5-0ubuntu0.18.04.3+esm1","binary_name":"evolution-data-server-online-accounts"},{"binary_name":"evolution-data-server-tests","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"gir1.2-camel-1.2","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_version":"3.28.5-0ubuntu0.18.04.3+esm1","binary_name":"gir1.2-ebook-1.2"},{"binary_name":"gir1.2-ebookcontacts-1.2","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"gir1.2-edataserver-1.2","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_version":"3.28.5-0ubuntu0.18.04.3+esm1","binary_name":"gir1.2-edataserverui-1.2"},{"binary_version":"3.28.5-0ubuntu0.18.04.3+esm1","binary_name":"libcamel-1.2-61"},{"binary_name":"libebackend-1.2-10","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"libebook-1.2-19","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"libebook-contacts-1.2-2","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"libecal-1.2-19","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_version":"3.28.5-0ubuntu0.18.04.3+esm1","binary_name":"libedata-book-1.2-25"},{"binary_name":"libedata-cal-1.2-28","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_version":"3.28.5-0ubuntu0.18.04.3+esm1","binary_name":"libedataserver-1.2-23"},{"binary_version":"3.28.5-0ubuntu0.18.04.3+esm1","binary_name":"libedataserverui-1.2-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110777.json"}},{"package":{"name":"evolution-data-server","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/evolution-data-server?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.34.1-1","3.34.1-1build1","3.34.1-1ubuntu1","3.34.1-2","3.34.3-2","3.35.91-1","3.35.92-1","3.36.0-1","3.36.1-1","3.36.1-2","3.36.2-0ubuntu1","3.36.3-0ubuntu1","3.36.3-0ubuntu1.1","3.36.4-0ubuntu1","3.36.5-0ubuntu1","3.36.5-0ubuntu1+esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"evolution-data-server"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"evolution-data-server-common"},{"binary_name":"evolution-data-server-tests","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"gir1.2-camel-1.2"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"gir1.2-ebackend-1.2"},{"binary_name":"gir1.2-ebook-1.2","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_name":"gir1.2-ebookcontacts-1.2","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"gir1.2-ecal-2.0"},{"binary_name":"gir1.2-edatabook-1.2","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_name":"gir1.2-edatacal-2.0","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"gir1.2-edataserver-1.2"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"gir1.2-edataserverui-1.2"},{"binary_name":"libcamel-1.2-62","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"libebackend-1.2-10"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"libebook-1.2-20"},{"binary_name":"libebook-contacts-1.2-3","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_name":"libecal-2.0-1","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_name":"libedata-book-1.2-26","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"libedata-cal-2.0-1"},{"binary_name":"libedataserver-1.2-24","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"libedataserverui-1.2-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110777.json"}},{"package":{"name":"evolution-data-server","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/evolution-data-server?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.40.4-1","3.42.0-2","3.42.1-1","3.42.2-1","3.42.3-1","3.42.4-1","3.43.3-1","3.44.0-2","3.44.1-0ubuntu2","3.44.2-0ubuntu1","3.44.4-0ubuntu1","3.44.4-0ubuntu1.1","3.44.4-0ubuntu1.2"],"ecosystem_specific":{"binaries":[{"binary_name":"evolution-data-server","binary_version":"3.44.4-0ubuntu1.2"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"evolution-data-server-common"},{"binary_name":"evolution-data-server-tests","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"gir1.2-camel-1.2","binary_version":"3.44.4-0ubuntu1.2"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"gir1.2-ebackend-1.2"},{"binary_name":"gir1.2-ebook-1.2","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"gir1.2-ebookcontacts-1.2","binary_version":"3.44.4-0ubuntu1.2"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"gir1.2-ecal-2.0"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"gir1.2-edatabook-1.2"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"gir1.2-edatacal-2.0"},{"binary_name":"gir1.2-edataserver-1.2","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"gir1.2-edataserverui-1.2","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"libcamel-1.2-63","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"libebackend-1.2-10","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"libebook-1.2-20","binary_version":"3.44.4-0ubuntu1.2"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"libebook-contacts-1.2-3"},{"binary_name":"libecal-2.0-1","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"libedata-book-1.2-26","binary_version":"3.44.4-0ubuntu1.2"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"libedata-cal-2.0-1"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"libedataserver-1.2-26"},{"binary_name":"libedataserverui-1.2-3","binary_version":"3.44.4-0ubuntu1.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110777.json"}},{"package":{"name":"evolution-data-server","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/evolution-data-server?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.50.0-1","3.50.1-1","3.50.2-1","3.50.2-1build1","3.50.3-1","3.52.0-1build1","3.52.0-1build2","3.52.0-1build3","3.52.3-0ubuntu1","3.52.3-0ubuntu1.1","3.52.3-0ubuntu1.2"],"ecosystem_specific":{"binaries":[{"binary_name":"evolution-data-server","binary_version":"3.52.3-0ubuntu1.2"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"evolution-data-server-common"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"evolution-data-server-tests"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"gir1.2-camel-1.2"},{"binary_name":"gir1.2-ebackend-1.2","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"gir1.2-ebook-1.2","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"gir1.2-ebookcontacts-1.2","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"gir1.2-ecal-2.0","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"gir1.2-edatabook-1.2","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"gir1.2-edatacal-2.0","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"gir1.2-edataserver-1.2","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"gir1.2-edataserverui-1.2","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"gir1.2-edataserverui4-1.0","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"libcamel-1.2-64t64","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"libebackend-1.2-11t64","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"libebook-1.2-21t64","binary_version":"3.52.3-0ubuntu1.2"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"libebook-contacts-1.2-4t64"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"libecal-2.0-3"},{"binary_name":"libedata-book-1.2-27t64","binary_version":"3.52.3-0ubuntu1.2"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"libedata-cal-2.0-2t64"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"libedataserver-1.2-27t64"},{"binary_name":"libedataserverui-1.2-4t64","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"libedataserverui4-1.0-0t64","binary_version":"3.52.3-0ubuntu1.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110777.json"}},{"package":{"name":"evolution-data-server","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/evolution-data-server?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.56.2-8","3.56.2-9"],"ecosystem_specific":{"binaries":[{"binary_name":"evolution-data-server","binary_version":"3.56.2-9"},{"binary_version":"3.56.2-9","binary_name":"evolution-data-server-common"},{"binary_name":"evolution-data-server-tests","binary_version":"3.56.2-9"},{"binary_version":"3.56.2-9","binary_name":"gir1.2-camel-1.2"},{"binary_name":"gir1.2-ebackend-1.2","binary_version":"3.56.2-9"},{"binary_name":"gir1.2-ebook-1.2","binary_version":"3.56.2-9"},{"binary_version":"3.56.2-9","binary_name":"gir1.2-ebookcontacts-1.2"},{"binary_version":"3.56.2-9","binary_name":"gir1.2-ecal-2.0"},{"binary_name":"gir1.2-edatabook-1.2","binary_version":"3.56.2-9"},{"binary_version":"3.56.2-9","binary_name":"gir1.2-edatacal-2.0"},{"binary_version":"3.56.2-9","binary_name":"gir1.2-edataserver-1.2"},{"binary_name":"gir1.2-edataserverui-1.2","binary_version":"3.56.2-9"},{"binary_name":"gir1.2-edataserverui4-1.0","binary_version":"3.56.2-9"},{"binary_name":"libcamel-1.2-64t64","binary_version":"3.56.2-9"},{"binary_version":"3.56.2-9","binary_name":"libebackend-1.2-11t64"},{"binary_version":"3.56.2-9","binary_name":"libebook-1.2-21t64"},{"binary_name":"libebook-contacts-1.2-4t64","binary_version":"3.56.2-9"},{"binary_version":"3.56.2-9","binary_name":"libecal-2.0-3"},{"binary_name":"libedata-book-1.2-27t64","binary_version":"3.56.2-9"},{"binary_name":"libedata-cal-2.0-2t64","binary_version":"3.56.2-9"},{"binary_version":"3.56.2-9","binary_name":"libedataserver-1.2-27t64"},{"binary_version":"3.56.2-9","binary_name":"libedataserverui-1.2-4t64"},{"binary_name":"libedataserverui4-1.0-0t64","binary_version":"3.56.2-9"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110777.json"}},{"package":{"name":"evolution-data-server","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/evolution-data-server?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.56.2-3","3.56.2-4","3.56.2-4build1","3.56.2-5","3.56.2-6","3.56.2-7","3.56.2-8"],"ecosystem_specific":{"binaries":[{"binary_name":"evolution-data-server","binary_version":"3.56.2-8"},{"binary_version":"3.56.2-8","binary_name":"evolution-data-server-common"},{"binary_name":"evolution-data-server-tests","binary_version":"3.56.2-8"},{"binary_version":"3.56.2-8","binary_name":"gir1.2-camel-1.2"},{"binary_version":"3.56.2-8","binary_name":"gir1.2-ebackend-1.2"},{"binary_name":"gir1.2-ebook-1.2","binary_version":"3.56.2-8"},{"binary_name":"gir1.2-ebookcontacts-1.2","binary_version":"3.56.2-8"},{"binary_name":"gir1.2-ecal-2.0","binary_version":"3.56.2-8"},{"binary_name":"gir1.2-edatabook-1.2","binary_version":"3.56.2-8"},{"binary_name":"gir1.2-edatacal-2.0","binary_version":"3.56.2-8"},{"binary_name":"gir1.2-edataserver-1.2","binary_version":"3.56.2-8"},{"binary_version":"3.56.2-8","binary_name":"gir1.2-edataserverui-1.2"},{"binary_version":"3.56.2-8","binary_name":"gir1.2-edataserverui4-1.0"},{"binary_name":"libcamel-1.2-64t64","binary_version":"3.56.2-8"},{"binary_version":"3.56.2-8","binary_name":"libebackend-1.2-11t64"},{"binary_name":"libebook-1.2-21t64","binary_version":"3.56.2-8"},{"binary_name":"libebook-contacts-1.2-4t64","binary_version":"3.56.2-8"},{"binary_name":"libecal-2.0-3","binary_version":"3.56.2-8"},{"binary_name":"libedata-book-1.2-27t64","binary_version":"3.56.2-8"},{"binary_name":"libedata-cal-2.0-2t64","binary_version":"3.56.2-8"},{"binary_name":"libedataserver-1.2-27t64","binary_version":"3.56.2-8"},{"binary_version":"3.56.2-8","binary_name":"libedataserverui-1.2-4t64"},{"binary_version":"3.56.2-8","binary_name":"libedataserverui4-1.0-0t64"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110777.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]}