CVE-2026-110777: Exposure of Sensitive Information to an Unauthorized Actor in Red Hat Red Hat Enterprise Linux 10

CVE-2026-110777 describes a flaw in evolution-data-server used in Red Hat Enterprise Linux 10. When a calendar event contains an ATTACH property with a file:// URI, the client automatically reads the referenced local file, base64-encodes its contents, and uploads it back to the server upon saving the event. There are no restrictions or validation on the file path or whether the attachment was originally from the server or added locally. This behavior allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files that the user can access by crafting malicious calendar events.

An attacker with access to a shared CalDAV calendar can exploit this vulnerability to exfiltrate arbitrary local files from the victim's system without their explicit consent. The confidentiality of sensitive information stored locally is compromised. There is no impact on integrity or availability reported. The CVSS score of 5.7 (medium severity) reflects the network attack vector with low complexity but requiring some privileges and user interaction.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-110777 for current remediation guidance. Until a fix is available, restrict access to shared CalDAV calendars and avoid interacting with untrusted calendar events containing attachments with file:// URIs.