CVE-2026-107398 · Other
NO FIX YET · SEE WHAT TO DO
Indico is an event management system. Before version 3.3.14, a path traversal flaw in building an event's offline copy let a malicious event manager read any local file the Indico process can read.
first public Oct 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any Indico deployment running a version before 3.3.14 where users can be event managers. Exposure comes from the offline-copy feature building file paths from user-controlled input, so the event manager role is the attack path. Instances already on 3.3.14 or later are not affected.
Not affected if no-event-managers, version-3.3.14-or-later
Who cares event-management, indico, self-hosted
pip show indico on a standard install.3.3.14.3.3.14 or later.Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the server. This issue has been patched in version 3.3.14.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.