{"id":"CVE-2026-107398","kind":"vulnerability","aliases":["CVE-2026-107398"],"related":[],"title":"Indico: event managers can read any server file via offline copy","description":"Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an \"offline copy\" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the server. This issue has been patched in version 3.3.14.","summary":"Indico is an event management system. Before version 3.3.14, a path traversal flaw in building an event's offline copy let a malicious event manager read any local file the Indico process can read.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-management","indico","other","self-hosted"],"not_affected_if":["no-event-managers","version-3.3.14-or-later"],"how_to_check":"- Check the installed Indico version in the server environment, for example with `pip show indico` on a standard install.\n- Confirm whether the instance is at a version before `3.3.14`.","fix":"- Indico: upgrade to `3.3.14` or later.","status":"open","published_at":"2026-11-13T18:17:26+00:00","first_seen_at":"2026-11-13T18:49:28+00:00","triaged_at":"2026-11-13T18:51:37+00:00","updated_at":"2026-11-13T18:51:37+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T18:51:37Z","model":"claude-haiku-5-5","output":{"fix":"- Indico: upgrade to `3.3.14` or later.","reach":"network","title":"Indico: event managers can read any server file via offline copy","impact":"medium","summary":"Indico is an event management system. Before version 3.3.14, a path traversal flaw in building an event's offline copy let a malicious event manager read any local file the Indico process can read.","audience":"businesses","category":"other","nicknames":[],"who_cares":["indico","self-hosted","event-management"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads server files readable by the Indico process user.","analyst_note":"","how_to_check":"- Check the installed Indico version in the server environment, for example with `pip show indico` on a standard install.\n- Confirm whether the instance is at a version before `3.3.14`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-3.3.14-or-later","no-event-managers"],"who_is_affected":"Any Indico deployment running a version before 3.3.14 where users can be event managers. Exposure comes from the offline-copy feature building file paths from user-controlled input, so the event manager role is the attack path. Instances already on 3.3.14 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4561,"output_tokens":466,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107398':14A,17A '-2026':13A,16A '3.3.14':34B,72C,120C 'abil':93C 'build':40B,80C 'content':97C 'copi':11A,45B,83C 'cve':12A,15A 'due':73C 'event':2A,19B,29B,42B,49B,66C,86C,89C 'event-manag':18B 'featur':64C 'feature-rich':63C 'file':8A,54B,101C 'flaw':38B 'host':25B 'indico':1A,21B,26B,56B,60C,109C 'issu':114C 'let':46B 'local':53B,100C 'malici':48B,88C 'manag':3A,20B,30B,50B,67C,90C 'offlin':10A,44B,82C 'patch':117C 'path':36B,76C 'prior':69C 'process':57B 'read':5A,51B,59B 'readabl':104C 'retriev':95C 'rich':65C 'run':108C 'self':24B 'self-host':23B 'server':7A,112C 'system':31B,68C 'travers':37B,77C 'user':107C 'version':33B,71C,119C 'via':9A 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Any Indico deployment running a version before 3.3.14 where users can be event managers. Exposure comes from the offline-copy feature building file paths from user-controlled input, so the event manager role is the attack path. Instances already on 3.3.14 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventmanagement","high","indico","other","selfhosted"],"campaign_type":null,"search_a":"'-107398':14A,17A '-2026':13A,16A 'copi':11A 'cve':12A,15A 'event':2A 'file':8A 'indico':1A 'manag':3A 'offlin':10A 'read':5A 'server':7A 'via':9A","search_b":"'3.3.14':34B 'build':40B 'copi':45B 'event':19B,29B,42B,49B 'event-manag':18B 'file':54B 'flaw':38B 'host':25B 'indico':21B,26B,56B 'let':46B 'local':53B 'malici':48B 'manag':20B,30B,50B 'offlin':44B 'path':36B 'process':57B 'read':51B,59B 'self':24B 'self-host':23B 'system':31B 'travers':37B 'version':33B","search_c":"'3.3.14':72C,120C 'abil':93C 'build':80C 'content':97C 'copi':83C 'due':73C 'event':66C,86C,89C 'featur':64C 'feature-rich':63C 'file':101C 'indico':60C,109C 'issu':114C 'local':100C 'malici':88C 'manag':67C,90C 'offlin':82C 'patch':117C 'path':76C 'prior':69C 'readabl':104C 'retriev':95C 'rich':65C 'run':108C 'server':112C 'system':68C 'travers':77C 'user':107C 'version':71C,119C 'vulner':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-13T15:11:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107398","severity":null,"published_at":"2026-11-13T18:17:26+00:00","modified_at":"2026-11-13T18:17:26+00:00","first_seen_at":"2026-11-13T18:49:28+00:00","fetched_at":"2026-11-13T18:49:28+00:00","note":null}],"documents":[{"id":148562,"url":"https://github.com/indico/indico/releases/tag/v3.3.14","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":148563,"url":"https://github.com/indico/indico/security/advisories/GHSA-h57f-c9j4-577x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-13T15:11:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}