CVE-2023-48308: Calendar app returns full stacktrace when an error happens while editing appointment

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-22 · updated 2026-06-17
Weakness: CWE-1258

Description

Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3

Affected products

Nextcloud Calendar application: from 3.0.0 before 4.5.3 — fixed in 4.5.3

How to fix

Upgrade to a fixed version: Nextcloud Calendar application 4.5.3. Check the vendor advisory for mitigations.

References

https://github.com/nextcloud/calendar/pull/5553
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8
https://github.com/nextcloud/calendar/pull/5553
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8

Get alerted when CVE-2023-48308 or the next vulnerability affects your stack