{"id":"CVE-2026-2604","aliases":["DEBIAN-CVE-2026-2604","DLA-4503-1","EUVD-2026-37506","GHSA-9h57-x6hw-v4j8","OESA-2026-2354","OESA-2026-2355","OESA-2026-2356","OESA-2026-2632","OESA-2026-2633","SUSE-SU-2026:0775-1","SUSE-SU-2026:0776-1","UBUNTU-CVE-2026-2604","USN-8055-1","USN-8055-2","openSUSE-SU-2026:10262-1","openSUSE-SU-2026:20864-1"],"status":"published","title":"Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling","description":"A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00311,"percentile":0.24115,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-73"],"published":"2026-02-18T00:00:00Z","modified":"2026-11-06T10:04:39Z","fixes":[{"ecosystem":"Debian:12","package":"evolution-data-server","fixed_in":["3.46.4-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"evolution-data-server","fixed_in":["3.56.2-8"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"evolution-data-server","fixed_in":["3.38.3-1+deb11u3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"evolution-data-server","fixed_in":["3.46.2-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"evolution-data-server","fixed_in":["3.46.2-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"evolution-data-server","fixed_in":["3.46.2-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"evolution-data-server","fixed_in":["3.38.4-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"evolution-data-server","fixed_in":["3.30.1-7.oe2003sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"evolution-data-server","fixed_in":["3.50.3-150600.3.9.1","3.42.5-150400.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"evolution-data-server","fixed_in":["3.50.3-150600.3.9.1","3.42.5-150400.3.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"evolution-data-server","fixed_in":["3.50.3-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"evolution-data-server","fixed_in":["3.28.5-0ubuntu0.18.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"evolution-data-server","fixed_in":["3.36.5-0ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"evolution-data-server","fixed_in":["3.44.4-0ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"evolution-data-server","fixed_in":["3.52.3-0ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"evolution-data-server","fixed_in":["3.56.2-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"evolution-data-server","fixed_in":["3.58.3-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.46.4-2+deb12u1"}]}],"versions":["3.46.4-2"]},{"source":"osv","ecosystem":"Debian:13","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.56.1-2","3.56.2-0+deb13u1","3.56.2-1","3.56.2-2","3.56.2-3","3.56.2-4","3.56.2-5","3.56.2-6","3.56.2-7","3.56.2-8","3.56.2-9","3.62.0-1","3.62.1-1","3.62.1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.56.2-8"}]}],"versions":["3.56.1-2","3.56.2-1","3.56.2-2","3.56.2-3","3.56.2-4","3.56.2-5","3.56.2-6","3.56.2-7"]},{"source":"osv","ecosystem":"Debian:11","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.3-1+deb11u3"}]}],"versions":["3.38.3-1","3.38.3-1+deb11u1","3.38.3-1+deb11u2"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.46.2-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.46.2-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.46.2-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.4-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.1-7.oe2003sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.50.3-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.50.3-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.50.3-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.42.5-150400.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.42.5-150400.3.10.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.5-0ubuntu0.18.04.3+esm1"}]}],"versions":["3.26.1-1ubuntu1","3.26.2-1ubuntu1","3.26.2.1-1ubuntu1","3.26.2.1-1ubuntu3","3.26.3-1ubuntu1","3.26.5-1ubuntu3","3.27.90-1ubuntu1","3.28.0-1ubuntu1","3.28.0-2ubuntu1","3.28.0-2ubuntu2","3.28.1-1ubuntu1","3.28.3-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.2","3.28.5-0ubuntu0.18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.5-0ubuntu1+esm1"}]}],"versions":["3.34.1-1","3.34.1-1build1","3.34.1-1ubuntu1","3.34.1-2","3.34.3-2","3.35.91-1","3.35.92-1","3.36.0-1","3.36.1-1","3.36.1-2","3.36.2-0ubuntu1","3.36.3-0ubuntu1","3.36.3-0ubuntu1.1","3.36.4-0ubuntu1","3.36.5-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.44.4-0ubuntu1.2"}]}],"versions":["3.40.4-1","3.42.0-2","3.42.1-1","3.42.2-1","3.42.3-1","3.42.4-1","3.43.3-1","3.44.0-2","3.44.1-0ubuntu2","3.44.2-0ubuntu1","3.44.4-0ubuntu1","3.44.4-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.52.3-0ubuntu1.2"}]}],"versions":["3.50.0-1","3.50.1-1","3.50.2-1","3.50.2-1build1","3.50.3-1","3.52.0-1build1","3.52.0-1build2","3.52.0-1build3","3.52.3-0ubuntu1","3.52.3-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.56.2-3ubuntu0.1"}]}],"versions":["3.56.0-1","3.56.1-2","3.56.1-2build1","3.56.2-1","3.56.2-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.44.4-0ubuntu1.2"}]}],"versions":["3.40.4-1","3.42.0-2","3.42.1-1","3.42.2-1","3.42.3-1","3.42.4-1","3.43.3-1","3.44.0-2","3.44.1-0ubuntu2","3.44.2-0ubuntu1","3.44.4-0ubuntu1","3.44.4-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.52.3-0ubuntu1.2"}]}],"versions":["3.50.0-1","3.50.1-1","3.50.2-1","3.50.2-1build1","3.50.3-1","3.52.0-1build1","3.52.0-1build2","3.52.0-1build3","3.52.3-0ubuntu1","3.52.3-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.56.2-3ubuntu0.1"}]}],"versions":["3.56.0-1","3.56.1-2","3.56.1-2build1","3.56.2-1","3.56.2-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.5-0ubuntu0.18.04.3+esm1"}]}],"versions":["3.26.1-1ubuntu1","3.26.2-1ubuntu1","3.26.2.1-1ubuntu1","3.26.2.1-1ubuntu3","3.26.3-1ubuntu1","3.26.5-1ubuntu3","3.27.90-1ubuntu1","3.28.0-1ubuntu1","3.28.0-2ubuntu1","3.28.0-2ubuntu2","3.28.1-1ubuntu1","3.28.3-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.2","3.28.5-0ubuntu0.18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.5-0ubuntu1+esm1"}]}],"versions":["3.34.1-1","3.34.1-1build1","3.34.1-1ubuntu1","3.34.1-2","3.34.3-2","3.35.91-1","3.35.92-1","3.36.0-1","3.36.1-1","3.36.1-2","3.36.2-0ubuntu1","3.36.3-0ubuntu1","3.36.3-0ubuntu1.1","3.36.4-0ubuntu1","3.36.5-0ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.58.3-2.1"}]}]}],"products":[{"vendor":"gnome","product":"evolution data server"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-2604","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440301","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/627","tags":["report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/03/msg00007.html","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/09/msg00031.html","tags":["web"]},{"url":"https://gitlab.gnome.org/GNOME/evolution-data-server/-/work_items/627","tags":["exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2604","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9h57-x6hw-v4j8"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2604.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-2604","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2354","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2355","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2356","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2632","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2633","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260775-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258307","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2604","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260776-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-2604","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2604","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8055-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8055-2","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-2604","title":"Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling","description":"A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.","status":"published","published":"2026-06-16T21:35:51.295Z","modified":"2026-11-05T19:32:27.233Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-73"],"updated_at":"2026-11-05T20:54:59.423743Z"}],"euvd":[{"id":"EUVD-2026-37506","description":"A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.","status":"published","published":"2026-06-16T21:35:51Z","modified":"2026-11-05T19:32:27Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-05T21:01:59.785126Z"}],"ghsa":[{"id":"GHSA-9h57-x6hw-v4j8","title":"A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file...","description":"A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.","status":"published","published":"2026-06-17T18:35:48Z","modified":"2026-09-26T00:32:17Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T15:12:27.845198Z"}],"nvd":[{"id":"CVE-2026-2604","description":"A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.","status":"published","published":"2026-06-17T13:20:15.937Z","modified":"2026-11-05T20:17:57.903Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-73"],"updated_at":"2026-11-05T21:56:41.057422Z"}],"osv":[{"id":"CVE-2026-2604","title":"Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling","description":"A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.","status":"published","published":"2026-06-16T21:35:51.295Z","modified":"2026-11-07T07:05:10.32946114Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"cwes":["CWE-73"],"updated_at":"2026-11-07T03:08:03.12653Z"},{"id":"DEBIAN-CVE-2026-2604","description":"A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.","status":"published","published":"2026-06-17T13:20:15.937Z","modified":"2026-11-06T10:04:39.833083719Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"OESA-2026-2354","title":"evolution-data-server security update","description":"The evolution-data-server package provides a personal information management application that provides integrated mail, calendaring and address book functionality. The evolution-data-server package provides a single database for common, desktop-wide information, such as a user\u0026amp;apos;s address book or calendar events.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.(CVE-2026-2604)","status":"published","published":"2026-05-15T11:11:19Z","modified":"2026-08-18T01:19:54.185180118Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2355","title":"evolution-data-server security update","description":"The evolution-data-server package provides a personal information management application that provides integrated mail, calendaring and address book functionality. The evolution-data-server package provides a single database for common, desktop-wide information, such as a user\u0026amp;apos;s address book or calendar events.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.(CVE-2026-2604)","status":"published","published":"2026-05-15T11:11:19Z","modified":"2026-08-18T01:19:57.878742615Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2356","title":"evolution-data-server security update","description":"The evolution-data-server package provides a personal information management application that provides integrated mail, calendaring and address book functionality. The evolution-data-server package provides a single database for common, desktop-wide information, such as a user\u0026amp;apos;s address book or calendar events.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.(CVE-2026-2604)","status":"published","published":"2026-05-15T11:11:19Z","modified":"2026-08-18T01:19:57.504600395Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2632","title":"evolution-data-server security update","description":"The evolution-data-server package provides a personal information management application that provides integrated mail, calendaring and address book functionality. The evolution-data-server package provides a single database for common, desktop-wide information, such as a user\u0026amp;apos;s address book or calendar events.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.(CVE-2026-2604)","status":"published","published":"2026-06-12T11:11:34Z","modified":"2026-08-18T01:20:04.739106791Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2633","title":"evolution-data-server security update","description":"The evolution-data-server package provides a personal information management application that provides integrated mail, calendaring and address book functionality. The evolution-data-server package provides a single database for common, desktop-wide information, such as a user\u0026amp;apos;s address book or calendar events.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.(CVE-2026-2604)","status":"published","published":"2026-06-12T11:11:34Z","modified":"2026-08-18T01:20:04.536569736Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2026-2604","description":"A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.","status":"published","published":"2026-02-18T00:00:00Z","modified":"2026-06-24T11:01:29.245800963Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"DLA-4503-1","title":"evolution-data-server - security update","status":"published","published":"2026-03-19T00:00:00Z","modified":"2026-03-19T19:30:58.474755Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"openSUSE-SU-2026:10262-1","title":"evolution-data-server-3.58.3-2.1 on GA media","description":"These are all security issues fixed in the evolution-data-server-3.58.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-26T00:00:00Z","modified":"2026-03-23T04:54:37.681225Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20864-1","title":"Security update for evolution-data-server","description":"This update for evolution-data-server fixes the following issues:\n\n- CVE-2026-2604: Canonicalize path before local cache file removal. (bsc#1258307)\n","status":"published","published":"2026-06-01T13:18:04Z","modified":"2026-06-04T18:24:27.39364373Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:0775-1","title":"Security update for evolution-data-server","description":"This update for evolution-data-server fixes the following issue:\n\n- CVE-2026-2604: arbitrary file deletion via inconsistent URI handling (bsc#1258307).\n","status":"published","published":"2026-03-03T13:19:14Z","modified":"2026-03-04T22:17:29.893883Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0776-1","title":"Security update for evolution-data-server","description":"This update for evolution-data-server fixes the following issue:\n\n- CVE-2026-2604: arbitrary file deletion via inconsistent URI handling (bsc#1258307).\n","status":"published","published":"2026-03-03T13:20:26Z","modified":"2026-03-04T22:17:29.930058Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"USN-8055-1","title":"evolution-data-server vulnerability","description":"It was discovered that Evolution Data Server incorrectly handled removing\nlocal cache files. An attacker could possibly use this issue to cause\nEvolution Data Server to remove arbitrary files.","status":"published","published":"2026-02-23T12:50:55Z","modified":"2026-06-22T09:31:18.491394706Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8055-2","title":"evolution-data-server vulnerability","description":"USN-8055-1 fixed a vulnerability in Evolution Data Server. This update\nprovides the corresponding update for Ubuntu 18.04 LTS and Ubuntu\n20.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Evolution Data Server incorrectly handled\n removing local cache files. An attacker could possibly use this issue\n to cause Evolution Data Server to remove arbitrary files.","status":"published","published":"2026-06-01T14:51:47Z","modified":"2026-06-22T09:31:20.674741056Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}