CVE-2026-2604: GNOME Evolution Data Server arbitrary file deletion in addressbook backend

CVE-2026-2604 · Severity: medium · CVSS 5.6 · Published 2026-06-17

A vulnerability in the Evolution Data Server, a component used to manage address books and calendars on Linux systems, could allow a malicious application to delete files on the host computer. By exploiting inconsistent security checks when handling contact photos, an attacker can bypass restrictions to remove important system or user files. This is particularly significant for sandboxed applications (like Flatpaks) that could use this flaw to break out of their restricted environment and delete configuration files that enforce security permissions.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Gnome, Red Hat.

Quick answers

Is CVE-2026-2604 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-2604 being exploited in the wild.
How severe is CVE-2026-2604?
Medium severity, with a CVSS score of 5.6, published 17 June 2026.
Which products and versions are affected?
Gnome Evolution Data Server < 3.59.3.
Is there a fix for CVE-2026-2604?
A patch was published on 2026-03-19: Debian LTS advisory DLA-4503-1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2604 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-2604?
Check whether you run Gnome Evolution Data Server, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A directory traversal vulnerability exists in the addressbook file backend (e-book-backend-file.c) of evolution-data-server. The flaw stems from inconsistent comparison logic between contact creation and deletion: creation uses an exact directory match via strcmp(), while deletion uses a prefix match via strncmp() on unresolved paths. An attacker can craft a malicious URI containing '../' sequences that bypasses the initial check but is later resolved by g_unlink() during contact deletion. A local attacker or a Flatpak application with D-Bus access to the org.gnome.evolution.dataserver.AddressBook service can exploit this to delete arbitrary files on the host filesystem. The issue is fixed by canonicalizing file paths using realpath() before performing prefix comparisons.

Affected products

  • GNOME Evolution Data Server < 3.59.3
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 10

Timeline

  • 2026-02-16: disclosed: Initial report in Red Hat Bugzilla
  • 2026-03-19: patched: Debian LTS advisory DLA-4503-1 released
  • 2026-06-17: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.