An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade evolution-develUpgrade evolution-debuginfoUpgrade evolutionUpgrade evolution-pstUpgrade evolution-helpUpgrade evolution-bogofilterUpgrade evolution-devel-docsUpgrade evolution-spamassassinUpgrade evolution-langpacks | Apr 17, 2025 | Apr 17, 2020 |
| Debian | — | Upgrade evolution | Jul 30, 2024 | Apr 17, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 17, 2020 |
| Suse | — | Upgrade evolution-develUpgrade evolutionUpgrade evolution-lang | Aug 9, 2024 | Apr 17, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub