Listen to this Post
This vulnerability exploits the interaction between calendar events and file handling in Nextcloud. A malicious actor with permission to create calendar events can craft an event with a special attachment. This attachment is not a real file but a link (webcal:// or a direct server path) pointing to a sensitive file hosted on the same Nextcloud instance. When another user, such as a recipient of the shared calendar event, opens or previews the event details, the Nextcloud frontend automatically triggers a download request for the linked file. The vulnerability lies in the lack of a user confirmation dialog or appropriate origin check for this automatic download action. Consequently, the server processes the request in the context of the victim user, who has higher privileges, and serves the targeted file directly to the attacker’s session without any warning. This allows unauthorized access to and exfiltration of files the victim can access, bypassing normal share permissions and user intent.
Platform: Nextcloud Calendar
Version: <4.7.17, <5.2.4
Vulnerability: Unauthorized file download
Severity: Medium
date: 2025-12-05
Prediction: Patched 2025-12-05
What Undercode Say:
curl -s http://nc-host/status.php | grep version find /var/www/nextcloud -name 'appinfo/info.xml' | xargs grep -l calendar grep -r "webcal://" /var/www/nextcloud/data/appdata_oc
How Exploit:
1. Attacker creates calendar event.
- Adds crafted attachment linking to `http://localhost/sensitive.pdf`.
3. Shares event with victim.
4. Victim views calendar.
5. File downloads automatically.
Protection from this CVE
Update to version 4.7.17 or 5.2.4.
Impact:
Unauthorized file access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
