CVE-2022-24838 Command Injection in Appointment Emails for Nextcloud Calendar

Medium 5.3 Published 11 Apr 2022 Updated 23 Apr 2025

Attackers can inject arbitrary SMTP commands via unsanitized email fields in appointment requests, potentially compromising email delivery or server integrity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-24838?

CVE-2022-24838 is a medium-severity command injection vulnerability in nextcloud security-advisories, published on 11 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject newlines to break out of the `RCPT TO:<BOOKING USER'S EMAIL> ` SMTP command and begin injecting arbitrary SMTP commands. It is recommended that Calendar is upgraded to 3.2.2. There are no workaround available.

Weakness: CWE-74

Which versions are affected by CVE-2022-24838?

It affects 1 product.

Products include Nextcloud Calendar.

How do I fix CVE-2022-24838?

No fix has been published for CVE-2022-24838 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-24838 being exploited?

There is no known exploitation of CVE-2022-24838 in the wild and no public exploit code.

Sources

Also known as GHSA-8xv5-4855-24qf.