CVE-2026-2604

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.

Score
CVSS 3.1 5.6 Medium
Status
Awaiting Analysis - secalert@redhat.com
Published
2026-06-16
Last modified
2026-09-25
Weaknesses
CWE-73

Affected products

References

 
 
© AVABIS GmbH privacypolicy about