CVE-2026-107398

The Indico event management system is vulnerable to a path traversal vulnerability in versions prior to 3.3.14 . When building an "offline copy" of an event, a malicious event manager can exploit this flaw to retrieve the content of any local file readable by the user running the Indico service o...

CVE-2026-107398 Indico: Local file disclosure through offline-copy path traversal

Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the serve...