An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade evolution-pstUpgrade evolution-helpUpgrade evolutionUpgrade evolution-develUpgrade evolution-debuginfoUpgrade evolution-bogofilterUpgrade evolution-langpacksUpgrade evolution-devel-docsUpgrade evolution-spamassassin | Apr 17, 2025 | Apr 17, 2020 |
| Debian | — | Upgrade evolution | Jul 30, 2024 | Apr 17, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 17, 2020 |
| Suse | — | Upgrade evolution-develUpgrade evolutionUpgrade evolution-lang | Aug 9, 2024 | Apr 17, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub