CVE-2024-37316: Nextcloud Calendar's event create can create attachments that link to other websites

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-14 · updated 2026-06-17
Weakness: CWE-241

Description

Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2.

Affected products

Nextcloud Calendar application: from 4.3.0 before 4.6.8 — fixed in 4.6.8

How to fix

Upgrade to a fixed version: Nextcloud Calendar application 4.6.8. Check the vendor advisory for mitigations.

References

https://github.com/nextcloud/calendar/pull/5966
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf
https://hackerone.com/reports/2457588
https://github.com/nextcloud/calendar/pull/5966
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf
https://hackerone.com/reports/2457588

Get alerted when CVE-2024-37316 or the next vulnerability affects your stack