evolution-data-server EUVD-2026-101521

Exploitation requires three concrete conditions: (1) the victim uses evolution-data-server with a shared/subscribed CalDAV calendar; (2) the attacker has write access to that shared calendar to inject an event whose ATTACH property holds a file:// URI; and (3) the victim interacts with the event such that it is saved, triggering EDS to read, base64-encode, and re-upload the referenced local file. The root cause is the absence of any file-path restriction or any check that an attachment originated from the server rather than being locally injected. Limiting factors that reduce real-world risk: authentication/write access to the shared calendar is needed (PR:L), user interaction is required (UI:R), and only files readable by the victim's user account can be exfiltrated (no privilege escalation). It does not affect integrity or availability.

This is a genuine but moderate-priority information-disclosure flaw, not a drop-everything issue. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) describes a network-reachable but authenticated (PR:L) attack that additionally requires victim interaction (UI:R) and yields high confidentiality impact with no integrity or availability effect - consistent with CWE-200. There is NO CISA KEV listing and NO public exploit referenced in the input, so exploitation status is 'no public exploit identified at time of analysis'; EPSS was not provided, so exploitation probability cannot be quantified. No SSVC decision data was supplied. The practical constraints are meaningful: the attacker must already have write access to a calendar the victim subscribes to (a shared CalDAV calendar) and the victim must interact with the malicious event, which makes this a targeted-abuse scenario rather than mass, unauthenticated internet exploitation. One data conflict to flag: the vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N computes to a CVSS 3.1 base score of 6.5, but the input states 5.7 - the numeric score and vector do not reconcile, so verify the authoritative score/vector with Red Hat/NVD.

An attacker with write access to a CalDAV calendar that the victim subscribes to creates a calendar event whose ATTACH property contains a file:// URI pointing to a sensitive local file (e.g. file:///home/user/.ssh/id_rsa). When the victim's evolution-data-server processes and saves the event, it silently reads that local file, base64-encodes it, and uploads it as an attachment back to the shared server where the attacker can retrieve it. No public proof-of-concept exploit is referenced in the provided data.