TI-2023-26171 Aliases CVE-2023-48308

Calendar app returns full stacktrace when an error happens while editing appointment

LOW 30CWE-1258Published 2023-12-21 · Updated 2024-11-27

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00547 46th percentileScored 2026-11-07

Fix Fixed security-advisories (nextcloud): 4.5.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nextcloud	security-advisories	3.0.0 to before 4.5.3	4.5.3	Patch available	CNA

security-advisories Vendornextcloud Affected 3.0.0 to before 4.5.3 Fixed in 4.5.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nextcloud:calendar::::::::	3.0.0 to before 4.5.3	Vulnerable	nextcloud

cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:* Versions 3.0.0 to before 4.5.3 Vulnerable ·nextcloud

Remediation

Fix · CNA security-advisories (nextcloud) Fixed in 4.5.3

Timeline

2026-10-02 Threatist record created from CVE-2023-48308

References

Patch 1

https://github.com/nextcloud/calendar/pull/5553

Advisory 1

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8

TI-2022-08650 Command Injection in Appointment Emails for Nextcloud Calendar CVSS 3.1CRITICAL 9.8
TI-2023-24171 Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive CVSS 3.1MEDIUM 4.3
TI-2025-40933 Nextcloud Calendar app used predictable proposal participant tokens CVSS 3.1MEDIUM 6.5
TI-2025-40961 Nextcloud Calendar attachments of local files are offered to downloaded CVSS 3.1MEDIUM 5.7
TI-2018-02759 Cross-site scripting in Nextcloud Calendar application CVSS 3.1MEDIUM 4.8
TI-2024-24828 Nextcloud Calendar's event create can create attachments that link to other websites CVSS 3.1MEDIUM 4.6

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences