CVE-2026-2604: Evolution Data Server Path Traversal Flaw

CVE-2026-2604 Overview

CVE-2026-2604 is a path traversal flaw in evolution-data-server, the GNOME backend that manages calendars, contacts, and mail data. The vulnerability resides in the addressbook file backend, which applies inconsistent validation when handling Uniform Resource Identifiers (URIs). A Flatpak application with D-Bus access can craft a malicious URI containing directory traversal sequences. The backend stores this URI without proper validation during contact creation or modification. When the contact is later deleted, a less strict check processes the URI and removes arbitrary files on the host filesystem. The flaw is tracked as CWE-73, External Control of File Name or Path.

Critical Impact
A sandboxed Flatpak application can escape its confinement and delete arbitrary files on the host, including Flatpak override files that govern sandbox permissions.

Affected Products

GNOME evolution-data-server (addressbook file backend)
Linux distributions shipping affected evolution-data-server packages, including Debian (per the Debian LTS announcement)
Red Hat Enterprise Linux components referencing evolution-data-server (per the Red Hat advisory)

Discovery Timeline

2026-06-17 - CVE-2026-2604 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-2604

Vulnerability Analysis

The vulnerability stems from asymmetric validation between two code paths that handle the same URI. During contact creation or modification, the addressbook file backend accepts a URI from a D-Bus client and persists it without rejecting directory traversal sequences such as ../. During contact deletion, a different routine resolves the stored URI and operates on the resulting filesystem path with a weaker check. The deletion routine therefore acts on a path that the storage routine should never have accepted.

Because evolution-data-server runs outside the Flatpak sandbox and reaches the host filesystem through D-Bus, a confined Flatpak application can invoke it to delete files the application itself could not reach. Deleting Flatpak override files (for example, files under ~/.local/share/flatpak/overrides/) can broaden the permissions granted to other Flatpak applications on subsequent launches, turning file deletion into a sandbox escape primitive.

Root Cause

The addressbook file backend trusts the URI on the write path and re-validates only on the delete path, using a less strict comparison. This inconsistent comparison logic [CWE-73] permits stored, attacker-controlled path components to escape the addressbook storage directory.

Attack Vector

Exploitation requires local access through a Flatpak application that holds D-Bus session access to evolution-data-server. The attacker creates or modifies a contact whose backing URI contains traversal sequences targeting a host file. Triggering deletion of that contact causes the backend to remove the targeted host file. User interaction is required, consistent with the CVSS vector for this issue.

No verified public proof-of-concept code is referenced in the available advisories. See the GNOME Issue Tracker and Red Hat Bug Report for technical details.

Detection Methods for CVE-2026-2604

Indicators of Compromise

Unexpected deletion of files outside the addressbook data directory ~/.local/share/evolution/addressbook/, particularly under ~/.local/share/flatpak/overrides/.
Addressbook source URIs that contain ../ sequences or absolute paths in evolution-data-server configuration or D-Bus traffic.
Flatpak applications issuing org.gnome.evolution.dataserver.AddressBook D-Bus calls with anomalous URI parameters.

Detection Strategies

Audit evolution-data-server logs for contact create, modify, and delete operations referencing URIs with traversal characters.
Monitor D-Bus session bus activity from Flatpak applications targeting the evolution addressbook interface.
Apply file integrity monitoring to Flatpak override directories and other security-sensitive user configuration paths.

Monitoring Recommendations

Enable Linux audit rules (auditd) on ~/.local/share/flatpak/overrides/ and on evolution-data-server data directories to record unlink and rename syscalls.
Alert on evolution-data-server processes performing file deletions outside their expected working directories.
Correlate Flatpak application launches with subsequent file deletion events on the host filesystem.

How to Mitigate CVE-2026-2604

Immediate Actions Required

Update evolution-data-server to the fixed version provided by your distribution, including the patched packages announced in the Debian LTS Announcement.
Review installed Flatpak applications and remove untrusted publishers, as exploitation depends on a malicious Flatpak with D-Bus access.
Inspect ~/.local/share/flatpak/overrides/ for unexpected changes that may have widened sandbox permissions.

Patch Information

Vendor fixes are tracked through the Red Hat CVE Advisory, the GNOME Issue Tracker, and the Debian LTS Announcement. Apply distribution updates that include the upstream fix enforcing consistent URI validation on both the storage and deletion paths.

Workarounds

Restrict the D-Bus session policy to prevent untrusted Flatpak applications from reaching org.gnome.evolution.dataserver.AddressBook.
Avoid installing Flatpak applications from unverified sources until the patched evolution-data-server is deployed.
Back up Flatpak override files and other critical user configuration so unauthorized deletions can be detected and reverted.

bash

# Verify the installed evolution-data-server version on Debian/Ubuntu
dpkg -l evolution-data-server | grep ^ii

# Verify the installed evolution-data-server version on RHEL/Fedora
rpm -q evolution-data-server

# Apply distribution updates
sudo apt update && sudo apt install --only-upgrade evolution-data-server   # Debian/Ubuntu
sudo dnf update evolution-data-server                                      # RHEL/Fedora