CVE-2026-111802: Nautilus Arbitrary File Deletion Vulnerability

CVE-2026-111802 Overview

A flaw in GNOME Nautilus allows arbitrary file deletion through symbolic link abuse during trash emptying operations. When a user unmounts or ejects a removable drive or disk image, Nautilus prompts them to empty the trash directory. The file manager does not verify whether the trash directory paths are symbolic links before performing deletion. An attacker who tricks a user into mounting a crafted storage volume and confirming the trash prompt can delete arbitrary files accessible to that user. The vulnerability is classified under [CWE-59] (Improper Link Resolution Before File Access).

Critical Impact
Local attackers can achieve arbitrary file deletion in the context of the targeted user by crafting a removable volume with symlinked trash paths and relying on user interaction with the Nautilus eject prompt.

Affected Products

GNOME Nautilus file manager
Linux distributions shipping Nautilus (including Red Hat Enterprise Linux)
Desktop environments using Nautilus as the default file manager

Discovery Timeline

2026-10-16 - CVE-2026-111802 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-111802

Vulnerability Analysis

Nautilus manages trash directories per mounted volume. Removable drives and mounted disk images each carry their own .Trash-$UID directory on the volume. When a user unmounts or ejects the volume, Nautilus presents an option to empty the trash on that volume before unmounting. The deletion routine resolves and removes the contents of the trash directory path without validating whether that path, or entries within it, are symbolic links pointing outside the mount.

An attacker crafts a storage volume where trash directory entries are symbolic links to arbitrary paths in the victim's home directory or other user-accessible locations. When the victim mounts the volume and later accepts the eject-time prompt to empty the trash, Nautilus follows the symlinks and deletes files at the target locations.

Root Cause

The root cause is missing symbolic link verification in the trash-emptying code path invoked during volume unmount. The deletion logic treats trash directory contents as regular files and directories without using O_NOFOLLOW semantics or validating that resolved paths remain within the mounted filesystem boundary. This qualifies as a classic [CWE-59] link-following flaw.

Attack Vector

Exploitation requires local access and user interaction. The attacker prepares a removable drive, USB stick, or disk image (ISO, raw image) that contains a .Trash-$UID directory populated with symbolic links to victim-owned files. The attacker then delivers the volume to the victim through physical handoff, social engineering, or by convincing the victim to download and mount a disk image. After the victim opens the volume in Nautilus and later ejects it, the eject prompt offers to empty the trash. Confirming the prompt triggers deletion along the attacker-controlled symlink targets.

See the GNOME Nautilus Merge Request #2179 for the upstream fix and the Red Hat Bug Report #2554410 for additional technical context.

Detection Methods for CVE-2026-111802

Indicators of Compromise

Presence of symbolic links inside .Trash-$UID directories on removable media, particularly links whose targets reference absolute paths outside the mount point.
Unexpected deletion of files in a user's home directory shortly after a removable drive or disk image was ejected through Nautilus.
Auditd records of unlink or unlinkat syscalls originating from the nautilus process targeting paths outside any mounted volume.

Detection Strategies

Monitor filesystem audit logs for file deletion events spawned by the nautilus process immediately following volume unmount or eject events.
Inspect newly inserted removable media for .Trash-* directories containing symlinks before allowing users to interact with them.
Correlate udisks2 mount and unmount events with subsequent high-volume delete activity under the mounting user's UID.

Monitoring Recommendations

Enable auditd rules on /home and other user data paths to capture delete syscalls and attribute them to the invoking process.
Alert on Nautilus processes performing deletions against paths that are not descendants of a currently mounted removable filesystem.
Track mount events from udisksd for disk images and USB volumes that contain pre-populated trash directories.

How to Mitigate CVE-2026-111802

Immediate Actions Required

Apply vendor updates for Nautilus as soon as patched packages are available from your Linux distribution.
Instruct users to decline the "Empty Trash" prompt when ejecting untrusted removable media or disk images.
Disable automatic mounting of removable media on shared or high-risk workstations until packages are patched.

Patch Information

The upstream fix is tracked in GNOME Nautilus Merge Request #2179, which adds symbolic link validation before deleting trash directory contents. Distribution-specific advisories are available from the Red Hat CVE-2026-111802 Advisory. Install the patched Nautilus package provided by your distribution vendor.

Workarounds

Avoid mounting untrusted removable drives, USB devices, or disk images in sessions that use Nautilus as the file manager.
When ejecting a removable volume, dismiss the "Empty Trash" prompt and unmount the volume without emptying the trash.
Restrict udisks2 auto-mount policies through polkit rules to require administrative confirmation for removable media.
Use an alternative file manager without this flaw for interacting with untrusted media until patches are deployed.

bash

# Example polkit rule to restrict udisks2 auto-mount for non-admin users
# /etc/polkit-1/rules.d/10-udisks2-restrict.rules
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.udisks2.filesystem-mount" &&
        !subject.isInGroup("wheel")) {
        return polkit.Result.AUTH_ADMIN;
    }
});