CVE-2022-24838

Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject newlines to break out of the `RCPT TO:<BOOKING USER'S EMAIL> ` SMTP command and begin injecting arbitrary SMTP commands. It is recommended that Calendar is upgraded to 3.2.2. There are no workaround available.

• CWE-74
• CWE-74

• https://github.com/nextcloud/calendar/commit/7b70edfb8a0fcf0926f613ababcbd56c6ecd9f35Patch, Third Party Advisory
• https://github.com/nextcloud/calendar/pull/4073Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qfThird Party Advisory
• https://github.com/nextcloud/calendar/commit/7b70edfb8a0fcf0926f613ababcbd56c6ecd9f35Patch, Third Party Advisory
• https://github.com/nextcloud/calendar/pull/4073Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qfThird Party Advisory

Published

Apr 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24831OpenClinica is an open source software for Electronic Data C…9.8
• CVE-2022-24832GoCD is an open source a continuous delivery server. The bun…6.8
• CVE-2022-24833PrivateBin is minimalist, open source online pastebin clone …6.1
• CVE-2022-24834Redis is an in-memory database that persists on disk. A spec…8.8
• CVE-2022-24836Nokogiri is an open source XML and HTML library for Ruby. No…7.5
• CVE-2022-24837HedgeDoc is an open-source, web-based, self-hosted, collabor…5.3
• CVE-2022-24839org.cyberneko.html is an html parser written in Java. The fo…7.5
• CVE-2022-2484 The signature check in the Nokia ASIK AirScale system mod…7.8
• CVE-2022-24840django-s3file is a lightweight file upload input for Django …9.8
• CVE-2022-24841fleetdm/fleet is an open source device management, built on …8.1
• CVE-2022-24842MinIO is a High Performance Object Storage released under GN…8.8
• CVE-2022-24843Gin-vue-admin is a backstage management system based on vue …7.5