← Vulnerability feed

Vulnerability record · CVE-2022-24838 · published 11 April 2022

CVE-2022-24838: Nextcloud calendar injection vulnerability

Nextcloud · Calendar

Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject newlines to break out of the `RCPT TO:<BOOKING USER'S EMAIL> ` SMTP command and begin injecting arbitrary SMTP commands. It is recommended that Calendar is upgraded to 3.2.2. There are no workaround available.

9.8 CVSS 3.1 Critical EPSS 33% · top 1.7% CWE-74 · Injection
9.8CVSS 3.1 base score, v2 7.5
33%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject newlines to break out of the `RCPT TO:<BOOKING USER'S EMAIL> ` SMTP command and begin injecting arbitrary SMTP commands. It is recommended that Calendar is upgraded to 3.2.2. There are no workaround available.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/nextcloud/calendar/commit/7b70edfb8a0fcf0926f613ababcbd56c6ecd9f35 PatchThird Party Advisory
https://github.com/nextcloud/calendar/pull/4073 PatchThird Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qf Third Party Advisory
https://github.com/nextcloud/calendar/commit/7b70edfb8a0fcf0926f613ababcbd56c6ecd9f35 PatchThird Party Advisory
https://github.com/nextcloud/calendar/pull/4073 PatchThird Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qf Third Party Advisory

Track CVE-2022-24838 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2025-66511Nextcloud calendar vulnerabilityNextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash …EPSS 0.30%6.5CVE-2023-48308Nextcloud calendar vulnerabilityNextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an except…EPSS 0.55%5.7CVE-2025-66550Nextcloud calendar vulnerabilityNextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachme…EPSS 0.34%4.8CVE-2018-3763Nextcloud calendar cross-site scripting vulnerabilityIn Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring…EPSS 0.61%4.6CVE-2024-37316Nextcloud calendar vulnerabilityNextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redir…EPSS 0.36%4.3CVE-2026-45286Nextcloud calendar information exposure vulnerabilityNextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user c…EPSS 0.46%4.3CVE-2023-45150Nextcloud calendar uncontrolled resource consumption vulnerabilityNextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings …EPSS 0.39%4.3CVE-2023-33183Nextcloud calendar improper authorization vulnerabilityCalendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMT…EPSS 0.44%

Source: NIST National Vulnerability Database (record CVE-2022-24838), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.