# CVE-2026-111802: GNOME Nautilus arbitrary file deletion via trash symlink

Source: https://junglewise.ai/threats/cve-2026-111802-a-flaw-was-found-in-nautilus-when-a-removable-drive-or-disk  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111802 · Severity: medium · CVSS 6.6 · Published 2026-10-16

Nautilus is a file manager used in GNOME desktop environments. When a user unmounts a removable drive or disk image, Nautilus prompts to empty the trash without checking if trash paths are symbolic links. An attacker can trick a user into mounting a crafted storage volume and deleting the trash, resulting in arbitrary deletion of files the user has access to.

Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome).

## Quick answers

**Is CVE-2026-111802 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111802 being exploited in the wild.

**How severe is CVE-2026-111802?** Medium severity, with a CVSS score of 6.6, published 16 October 2026.

**Which products and versions are affected?** GNOME Nautilus.

**Is there a fix for CVE-2026-111802?** No fixed version is recorded yet. Do not select "Empty" when prompted to empty trash upon ejecting USB devices, or disable the "Empty Trash" functionality when ejecting removable media.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-16"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111802 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-111802?** Check whether you run Gnome Nautilus. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Do not select "Empty" when prompted to empty trash upon ejecting USB devices, or disable the "Empty Trash" functionality when ejecting removable media.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-16"}]

## Technical details

The vulnerability is a symlink-following flaw (CWE-59) in Nautilus's trash-emptying logic. When a removable drive is unmounted, Nautilus prompts the user to empty trash without validating whether trash directory paths are symbolic links, allowing an attacker to craft a malicious storage volume with symlinked trash directories. Successful exploitation requires the victim to mount the crafted volume, confirm the trash-deletion prompt, and have local user privileges; no code execution or privilege escalation occurs.

## Affected products

- GNOME Nautilus

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-111802](https://access.redhat.com/security/cve/CVE-2026-111802)

## Related threats

- [libtiff PixarLogDecode buffer overflow in libtiff.so](https://junglewise.ai/threats/cve-2016-5317-libtiff-pixarlogdecode-buffer-overflow-in-libtiff-so)