Read the docs
TI-2023-14492 Aliases CVE-2023-30678GHSA-6p4h-xvj3-j477

Path traversal in Samsung Calendar

Priority LOW 24CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Potential zip path traversal vulnerability in Calendar application prior to version 12.4.07.15 in Android 13 allows attackers to write arbitrary file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00204 10th percentileScored 2026-11-07
Fix Fixed Calendar (Samsung Mobile): 12.4.07.15 in Android 13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungCalendar—12.4.07.15 in Android 13Patch availableCNA
  • Calendar VendorSamsung Affected — Fixed in 12.4.07.15 in Android 13 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:*before 12.4.07.15VulnerableSamsung
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*13.0Running onGoogle
  • cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:* Versions before 12.4.07.15 Vulnerable ·Samsung
  • cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* Versions 13.0 Running on ·Google

Remediation

  • Fix · CNA Calendar (Samsung Mobile) Fixed in 12.4.07.15 in Android 13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-30678
  2. 2026-10-03 Alias added: GHSA-6p4h-xvj3-j477

References

Advisory 1

  • TI-2022-18909 Improper access control in Samsung Calendar CVSS 3.1MEDIUM 5.5
  • TI-2025-15031 Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and… CVSS 3.1MEDIUM 4.6
  • TI-2023-07865 Improper access control in Samsung Calendar prior to versions 12.4.02.9000 in Android 13… CVSS 3.1MEDIUM 4.0
  • TI-2022-14823 Improper authorization in Samsung Calendar CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences