CVE-2026-2604: Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling

Severity: medium (CVSS 5.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-17 · updated 2026-09-25
Weakness: CWE-73

Description

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.

Affected products

GNOME Evolution Data Server: before 3.59.3 — fixed in 3.59.3
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 6: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions

How to fix

Upgrade to a fixed version: GNOME Evolution Data Server 3.59.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-2604 or the next vulnerability affects your stack