CVE-2026-2604: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-2604 is an arbitrary file deletion vulnerability in GNOME's evolution-data-server, caused by inconsistent URI comparison logic in the addressbook file backend. A Flatpak application with D-Bus access to the addressbook service can craft a malicious URI containing directory traversal sequences (../) that bypasses validation during contact creation but passes a weaker check during contact deletion, resulting in deletion of arbitrary files on the host filesystem. Affected versions include all GNOME Evolution Data Server releases prior to 3.59.3; Red Hat distributions are also listed as affected. It carries a CVSS v3.1 base score of 5.6 (Medium) (Red Hat Bugzilla, Oracle Advisory).

The root cause is classified as CWE-73 (External Control of File Name or Path). The vulnerability exists in e-book-backend-file.c, where two functions apply inconsistent security checks on contact photo/logo URIs: is_backend_owned_uri() uses strcmp() for an exact directory match (rejecting ../ traversal), while maybe_delete_uri() uses strncmp() for a prefix match only, allowing traversal sequences to pass. A malicious URI is stored verbatim in the SQLite database during contact creation, then during deletion g_unlink() resolves the ../ sequences and deletes the traversed target. Because both E_CONTACT_PHOTO and E_CONTACT_LOGO fields are processed independently, a single crafted contact can delete two arbitrary files per operation. The recommended fix is to canonicalize the file path using realpath() in maybe_delete_uri() before performing the prefix comparison (Red Hat Bugzilla).

Successful exploitation allows a sandboxed Flatpak application to delete arbitrary files on the host filesystem, including critical Flatpak override files that enforce permission restrictions at app-specific, user-wide, or system-wide levels. Deletion of override files could effectively escalate the Flatpak application's permissions, enabling further compromise of the host system. While confidentiality is not directly impacted, the high integrity impact and potential for permission escalation make this a meaningful sandbox escape vector (Red Hat Bugzilla, Oracle Advisory).

A proof-of-concept script demonstrating the issue was attached to the Red Hat Bugzilla report at the time of disclosure, and NVD's SSVC assessment classifies exploitation status as 'poc' (Red Hat Bugzilla). There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.304%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access, low privileges, user interaction, and D-Bus access to the addressbook service, limiting the attack surface primarily to Flatpak sandbox escape scenarios.

1. Prerequisite: Attacker controls a Flatpak application that has been granted D-Bus access to org.gnome.evolution.dataserver.AddressBook (either by default or through a misconfigured Flatpak manifest).
2. Craft malicious URI: Construct a vCard contact with a PHOTO or LOGO field containing a file:// URI that begins with the evolution-data-server photo directory path followed by ../ traversal sequences pointing to the target file (e.g., file:///home/user/.local/share/flatpak/overrides/../../../target_file).
3. Create or modify contact: Use the D-Bus API to create or update a contact with the crafted URI. The is_backend_owned_uri() function rejects the URI as backend-owned (due to strcmp exact match failing), so the URI is stored verbatim in the SQLite database without transformation.
4. Trigger deletion: Delete the contact via the D-Bus API. The maybe_delete_uri() function retrieves the stored URI and applies a strncmp() prefix check, which passes because the URI starts with the photo directory path.
5. Arbitrary file deleted: remove_file() calls g_unlink() on the unresolved path, which resolves the ../ sequences and deletes the target file on the host filesystem.
6. Repeat for second file: Since both E_CONTACT_PHOTO and E_CONTACT_LOGO are processed independently, a single contact with two crafted URIs can delete two arbitrary files per deletion operation, such as Flatpak override files that restrict the application's permissions (Red Hat Bugzilla).

• File System: Unexpected deletion of files in ~/.local/share/flatpak/overrides/, /var/lib/flatpak/overrides/, or other critical directories; missing Flatpak override files that previously existed.
• Logs: Evolution Data Server logs (e.g., ~/.local/share/gnome-logs/ or journal) showing g_warning messages such as "Unable to cleanup photo uri" for unexpected paths, or successful Deleting uri file: log entries referencing paths outside the photo directory.
• D-Bus Activity: Unusual D-Bus calls to org.gnome.evolution.dataserver.AddressBook from Flatpak applications, particularly rapid contact creation followed by deletion; D-Bus monitor logs showing vCard data with PHOTO or LOGO fields containing ../ sequences.
• Process: The evolution-addressbook-factory process performing unlink() syscalls on files outside of ~/.local/share/evolution/addressbook/ (detectable via strace or auditd rules on unlink/unlinkat syscalls) (Red Hat Bugzilla).

The upstream fix is to upgrade to GNOME Evolution Data Server version 3.59.3 or later, which canonicalizes file paths using realpath() before performing prefix comparisons in maybe_delete_uri(). Patches have been issued for Ubuntu (USN-8055-1, USN-8055-2), SUSE (SUSE-2026-0776-1), Debian (DLA-4503-1), and Amazon Linux 2 (ALAS2-2026-3179). Oracle Solaris 11.4 users should apply the patch referenced in the April 2026 Third Party Bulletin (Oracle Advisory). As a workaround where patching is not immediately possible, restrict Flatpak applications' D-Bus access to org.gnome.evolution.dataserver.AddressBook, implement file integrity monitoring on critical Flatpak override directories, and audit Flatpak manifests to remove unnecessary D-Bus permissions.

The vulnerability was reported by OSIDB and tracked via Red Hat Bugzilla, with Red Hat assigning it medium severity. The OpenSUSE project noted the fix in their April 2026 Tumbleweed monthly update summary. Coverage has appeared on Linux security news aggregators including LinuxSecurity.com and LinuxCompatible.org following distribution advisories. No notable independent researcher commentary or significant social media discussion has been identified beyond standard distribution security announcement channels.