Directory Traversal Vulnerability in Evolution Data Server Affecting Flatpak Applications

CVE-2026-2604

What is CVE-2026-2604?

A vulnerability exists in the Evolution Data Server, where improper comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to create a malicious URI containing directory traversal sequences. This flaw permits the URI to be stored without adequate validation during the creation or modification of contacts. Critically, during the contact deletion process, this URI is processed with a less stringent validation, potentially enabling deletion of arbitrary files on the host filesystem. This includes the risk of removing sensitive Flatpak override files, which could significantly compromise system integrity and user data safety.

References