CVE-2026-2604 GNOME CVE debrief

Who should care

Defenders responsible for managing evolution-data-server installations, especially in environments with untrusted Flatpak applications, should assess exposure and prioritize patching.

Why it matters

The CVE-2026-2604 flaw in evolution-data-server allows a Flatpak application with D-Bus access to delete arbitrary files on the host filesystem. Defenders should prioritize verifying and patching evolution-data-server installations, especially in environments with untrusted Flatpak applications, to prevent potential elevation of privileges and compromise of sensitive data.

• Potential deletion of critical system files
• Elevation of privileges for untrusted Flatpak applications
• Compromise of sensitive data through file deletion
• Verification of evolution-data-server installations and patches

Technical summary

The evolution-data-server flaw allows a Flatpak application with D-Bus access to craft a malicious URI, potentially leading to the deletion of arbitrary files on the host filesystem. This occurs due to inconsistent comparison logic in the addressbook file backend. The URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, enabling the deletion of critical system files. Defenders should prioritize verifying and patching evolution-data-server installations, especially in environments with untrusted Flatpak applications.

Defensive priority

Defenders should prioritize verifying and patching evolution-data-server installations, especially in environments with untrusted Flatpak applications.

Recommended defensive actions

• Verify and apply patches for evolution-data-server
• Restrict D-Bus access for untrusted Flatpak applications
• Monitor for suspicious activity related to contact creation and deletion
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the flaw in evolution-data-server, including its CVSS score and potential impact. The flaw allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. The source detail is limited, so defenders should focus

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.