---
id: "CVE-2026-107398"
page: "https://infrastack.ai/live/CVE-2026-107398"
kind: "vulnerability"
aliases: ["CVE-2026-107398"]
title: "Indico: event managers can read any server file via offline copy"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["event-management", "indico", "other", "self-hosted"]
not_affected_if: ["no-event-managers", "version-3.3.14-or-later"]
published_at: "2026-11-13T18:17:26+00:00"
first_seen_at: "2026-11-13T18:49:28+00:00"
updated_at: "2026-11-13T18:51:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107398", "first_seen_at": "2026-11-13T18:49:28+00:00"}]
exploit_sources: []
---

# Indico: event managers can read any server file via offline copy

Link for people: https://infrastack.ai/live/CVE-2026-107398 (this .md is for agents)

Indico is an event management system. Before version 3.3.14, a path traversal flaw in building an event's offline copy let a malicious event manager read any local file the Indico process can read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Indico version in the server environment, for example with `pip show indico` on a standard install.
- Confirm whether the instance is at a version before `3.3.14`.

## Fix

- Indico: upgrade to `3.3.14` or later.

## Timeline

- 2026-11-13T18:49:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107398

## Documents

- [advisory] Vendor advisory: github.com https://github.com/indico/indico/security/advisories/GHSA-h57f-c9j4-577x
- [fix] Release notes: github.com https://github.com/indico/indico/releases/tag/v3.3.14

## From the sources

Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the server. This issue has been patched in version 3.3.14.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_