A flaw in the calendar component of evolution-data-server allows a crafted calendar event to embed a file:// URI in its ATTACH property. When the event is saved, the client reads the local file without any path restrictions, base64‑encodes the content and uploads it to the server, enabling an attacker to exfiltrate arbitrary files that the user has access to. The weakness is a lack of input validation and absence of ownership checks, constituting an information disclosure vulnerability (CWE‑200).

The vulnerability affects Red Hat Enterprise Linux distributions 6 through 10, as the evolution-data-server package is available on all versions indexed in the Red Hat Packages repository. The issue is present in any release that has not applied the specific patched version of the package.

The CVSS score of 5.7 indicates a moderate impact. Exploitation requires an attacker to have access to a shared CalDAV calendar and the user to open or edit a malicious event. Because the flaw enables local file disclosure rather than remote code execution, the risk is limited to data leakage. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Nonetheless, the attack vector—manipulating calendar events—is realistic for targeted enterprises. Organizations should treat this as a moderate‑to‑high risk for environments maintaining shared calendars.