Executive brief
A vulnerability in the Evolution Data Server, a component used to manage address books and calendars on Linux systems, could allow a malicious application to delete files on the host computer. By exploiting inconsistent security checks when handling contact photos, an attacker can bypass restrictions to remove important system or user files. This is particularly significant for sandboxed applications (like Flatpaks) that could use this flaw to break out of their restricted environment and delete configuration files that enforce security permissions.
Technical details
A directory traversal vulnerability exists in the addressbook file backend (e-book-backend-file.c) of evolution-data-server. The flaw stems from inconsistent comparison logic between contact creation and deletion: creation uses an exact directory match via strcmp(), while deletion uses a prefix match via strncmp() on unresolved paths. An attacker can craft a malicious URI containing '../' sequences that bypasses the initial check but is later resolved by g_unlink() during contact deletion. A local attacker or a Flatpak application with D-Bus access to the org.gnome.evolution.dataserver.AddressBook service can exploit this to delete arbitrary files on the host filesystem. The issue is fixed by canonicalizing file paths using realpath() before performing prefix comparisons.
Affected products
- GNOME Evolution Data Server < 3.59.3
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-02-16: disclosed: Initial report in Red Hat Bugzilla
- 2026-03-19: patched: Debian LTS advisory DLA-4503-1 released
- 2026-06-17: advisory: NVD publication date
References
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/security/cve/CVE-2026-2604
- https://bugzilla.redhat.com/show_bug.cgi?id=2440301
- https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/627
- https://lists.debian.org/debian-lts-announce/2026/03/msg00007.html
- https://gitlab.gnome.org/GNOME/evolution-data-server/-/work_items/627