# CVE-2026-2604: GNOME Evolution Data Server arbitrary file deletion in addressbook backend

Source: https://junglewise.ai/threats/cve-2026-2604-gnome-evolution-data-server-arbitrary-file-deletion-in-addressbook  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-2604 · Severity: medium · CVSS 5.6 · Published 2026-06-17

A vulnerability in the Evolution Data Server, a component used to manage address books and calendars on Linux systems, could allow a malicious application to delete files on the host computer. By exploiting inconsistent security checks when handling contact photos, an attacker can bypass restrictions to remove important system or user files. This is particularly significant for sandboxed applications (like Flatpaks) that could use this flaw to break out of their restricted environment and delete configuration files that enforce security permissions.

Technologies: [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10), [Red Hat Enterprise Linux 6](https://junglewise.ai/threats/technologies/enterprise-linux-6), [Red Hat Enterprise Linux 7](https://junglewise.ai/threats/technologies/enterprise-linux-7), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-2604 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2604 being exploited in the wild.

**How severe is CVE-2026-2604?** Medium severity, with a CVSS score of 5.6, published 17 June 2026.

**Which products and versions are affected?** Gnome Evolution Data Server < 3.59.3.

**Is there a fix for CVE-2026-2604?** A patch was published on 2026-03-19: Debian LTS advisory DLA-4503-1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2604 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-2604?** Check whether you run Gnome Evolution Data Server, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A directory traversal vulnerability exists in the addressbook file backend (e-book-backend-file.c) of evolution-data-server. The flaw stems from inconsistent comparison logic between contact creation and deletion: creation uses an exact directory match via strcmp(), while deletion uses a prefix match via strncmp() on unresolved paths. An attacker can craft a malicious URI containing '../' sequences that bypasses the initial check but is later resolved by g_unlink() during contact deletion. A local attacker or a Flatpak application with D-Bus access to the org.gnome.evolution.dataserver.AddressBook service can exploit this to delete arbitrary files on the host filesystem. The issue is fixed by canonicalizing file paths using realpath() before performing prefix comparisons.

## Affected products

- GNOME Evolution Data Server < 3.59.3
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10

## Timeline

- 2026-02-16: disclosed: Initial report in Red Hat Bugzilla
- 2026-03-19: patched: Debian LTS advisory DLA-4503-1 released
- 2026-06-17: advisory: NVD publication date

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-2604](https://access.redhat.com/security/cve/CVE-2026-2604)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2440301](https://bugzilla.redhat.com/show_bug.cgi?id=2440301)
- [https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/627](https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/627)
- [https://lists.debian.org/debian-lts-announce/2026/03/msg00007.html](https://lists.debian.org/debian-lts-announce/2026/03/msg00007.html)
- [https://gitlab.gnome.org/GNOME/evolution-data-server/-/work_items/627](https://gitlab.gnome.org/GNOME/evolution-data-server/-/work_items/627)

## Related threats

- [GNOME evolution-data-server file read via CalDAV ATTACH property](https://junglewise.ai/threats/cve-2026-110777-a-flaw-was-found-in-evolution-data-server-calendar-events)
- [Red Hat yggdrasil-worker-package-manager argument injection in APT backend](https://junglewise.ai/threats/cve-2026-18157-red-hat-yggdrasil-worker-package-manager-argument-injection-in)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)