Description
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.
Affected products
nextcloud: calendar
References4
- github.com/nextcloud/security-advisories/security/advisories/GH… PatchVendor Advisory
- hackerone.com/reports/3112033 Issue TrackingVendor Advisory
- github.com/nextcloud/calendar/commit/63a6c398db01391eb9fd5297a0… Patch
- github.com/nextcloud/calendar/pull/6971 Issue Tracking
Metrics
- CVSS 3.1
-
5.7
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - EPSS — exploit probability
- 0% percentile: 31 · as of 11 November 2026
- CWE
- CWE-241
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.