CVE-2026-2604: evolution-data-server Directory Traversal File Deletion Vulnerability

Technical summary

The vulnerability exists in evolution-data-server's addressbook file backend due to a mismatch between two validation routines. During contact creation and modification, the URI validation is overly permissive and does not reject sequences like "../" that could escape the intended directory. During deletion, a separate code path applies weaker validation checks that fail to prevent directory traversal. This inconsistency allows an attacker with D-Bus access (a privilege available to Flatpak applications) to craft a contact with a traversal-laden URI, then trigger deletion of that contact to achieve arbitrary file deletion on the host filesystem. The vulnerability is classified under CWE-73 (External Control of File Name or Path), indicating the core issue is insufficient path canonicalization and validation.

Business impact

Organizations deploying Flatpak-containerized applications in multi-user environments face a localized privilege escalation risk. An attacker with user-level access could create or modify contacts via a vulnerable application, then delete critical files belonging to other users or the system itself. If Flatpak override files are targeted, an attacker could disable sandboxing controls and escalate to more severe exploitation. In enterprise environments where Flatpak is used for secure application isolation, this vulnerability undermines the isolation guarantees. The medium CVSS score reflects the requirement for local user interaction and user action (deletion confirmation), but the impact is still significant because file deletion is often irreversible and can disrupt system integrity.

Affected systems

The vulnerability affects evolution-data-server, a core component of the GNOME ecosystem that manages contact, calendar, and mail data. Applications linked to or using evolution-data-server via D-Bus are potentially affected, particularly when running under Flatpak sandbox restrictions. Flatpak applications with D-Bus access to evolution-data-server are the primary attack vector. The vulnerability does not appear to require administrative privileges; a standard user running a malicious or compromised Flatpak application can trigger the flaw.

Exploitability

Exploitation requires three preconditions: the attacker must have local user access, the vulnerable evolution-data-server must be running and accessible via D-Bus, and a Flatpak application must have D-Bus permissions to interact with the service. The attacker then crafts a specially formed contact URI and triggers contact creation or modification followed by deletion. User interaction is required (the contact must be deleted), which is why the CVSS score reflects a lower complexity. However, in scenarios where applications programmatically manage contacts or where users are socially engineered to delete suspicious contacts, the attack becomes more practical. This is not remotely exploitable and does not require elevated privileges, limiting but not eliminating the threat.

Remediation

Apply security updates from your distribution as they become available. The fix involves aligning validation logic between contact creation/modification and deletion routines to consistently reject directory traversal sequences in URIs. Administrators should verify that evolution-data-server is updated across all systems running Flatpak applications. Additionally, review Flatpak override policies to restrict D-Bus access to evolution-data-server for untrusted applications unless explicitly required. Users should avoid accepting or manually creating contacts from untrusted sources, especially those containing unusual file paths.

Patch guidance

Monitor your distribution's security advisories and package repositories for evolution-data-server updates addressing this vulnerability. Verify the package version against your vendor's patch release notes—the fix should include changes to the addressbook backend's URI validation code. Once patches are released, prioritize updating systems running Flatpak, particularly those in multi-user environments. Test the update in a controlled environment before broad deployment to ensure compatibility with existing contact databases. Restart evolution-data-server (or the affected applications) after updating to activate the fix.

Detection guidance

Monitor for unusual contact deletion patterns, particularly contacts with URIs containing traversal sequences ("../", "..\", etc.). Audit evolution-data-server logs for failed or suspicious URI validation attempts during contact operations. File integrity monitoring (FIM) tools can detect unexpected file deletions, especially of Flatpak configuration files in ~/.local/share/flatpak or /var/lib/flatpak. Track D-Bus method calls to evolution-data-server from Flatpak applications, especially those calling contact creation, modification, and deletion methods in rapid succession. Check for file system operations by Flatpak processes that escape their intended sandbox directories.

Why prioritize this

Although the CVSS score is MEDIUM (5.6), prioritize this vulnerability because it affects system integrity and containerization security. In Flatpak-heavy environments, the ability to delete arbitrary files—including sandboxing controls—represents a significant privilege escalation vector. The lack of KEV (Known Exploited Vulnerabilities) status does not indicate low threat; it reflects the relative recency of the vulnerability. Local user attacks against sandbox escapes should be treated seriously in multi-user systems. Prioritize patching for systems where Flatpak is heavily deployed for security isolation, as the vulnerability directly undermines that isolation model.

Risk score, explained

The CVSS 3.1 score of 5.6 (MEDIUM) reflects a combination of factors: local attack vector (AV:L) limits the threat to authenticated users; low attack complexity (AC:L) means minimal technical sophistication is needed once access is gained; low privileges required (PR:L) indicates a standard user can exploit this; user interaction required (UI:R) means the contact must be deliberately or inadvertently deleted. The high integrity impact (I:H) recognizes that arbitrary file deletion is severe. The low availability impact (A:L) is applied because while critical files can be deleted, the scope is limited to files the Flatpak process has access to. The unchanged scope (S:U) reflects that the impact is confined to the local user context, not cross-boundary.

Frequently asked questions