Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the server. This issue has been patched in version 3.3.14.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 13 Nov 2026 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the server. This issue has been patched in version 3.3.14. | |
| Title | Indico: Local file disclosure through offline-copy path traversal | |
| Weaknesses | CWE-23 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-11-13T17:52:33.232Z
Reserved: 2026-10-07T21:07:54.989Z
Link: CVE-2026-107398
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-13T18:17:26.153
Modified: 2026-11-13T18:17:26.643
Link: CVE-2026-107398
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses