CVE-2026-107398
Indico: Local file disclosure through offline-copy path traversal
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the server. This issue has been patched in version 3.3.14.
| CWE | CWE-23 |
| Vendor | indico |
| Product | indico |
| Published | Nov 13, 2026 |
| Last Updated | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for indico indico
Be the first to know when new unknown vulnerabilities affecting indico indico are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
indico / indico
< 3.3.14