evolution-data-server CVE-2026-2604

Exploitation requires a Flatpak application that has been explicitly granted access to the host D-Bus session (i.e., --socket=session-bus or equivalent D-Bus policy override in the Flatpak manifest or user override file). This is a non-default Flatpak permission - applications must have been configured with this access, either by the distributor or by the user. Additionally, a human user must trigger contact deletion through an EDS-integrated client (UI:R per CVSS), meaning the attacker cannot fully automate the destructive step without social engineering. The attack is constrained to local session scope (AV:L) and requires low-privilege caller access (PR:L). Exploitation is limited by the Flatpak D-Bus access requirement (non-default), mandatory user interaction for the deletion trigger, and the fact that the attacker can only delete files - not read or overwrite them (C:N in CVSS). Non-Flatpak deployments or systems that do not expose EDS over D-Bus to Flatpak sandboxes are not affected by this attack path.

The CVSS 3.1 base score of 5.6 (AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L) accurately reflects a medium-severity, locally-scoped flaw. The local attack vector (AV:L) and required low privilege (PR:L) constrain exploitation to scenarios where an attacker already controls a Flatpak application with D-Bus session access - a non-trivial prerequisite. User interaction (UI:R) further limits opportunistic exploitation, as a human must trigger the contact deletion action. The high integrity impact (I:H) is the most significant signal: deletion of Flatpak override files could persistently weaken application sandboxing without user awareness, making this more than a simple file-deletion nuisance. No EPSS score was provided, and this CVE does not appear in CISA KEV, meaning no confirmed in-the-wild exploitation is known. No POC has been identified. Despite the relatively modest CVSS score, the potential to silently erode Flatpak sandbox controls elevates the real-world concern for desktop Linux environments heavily reliant on Flatpak containment as a security boundary.

An attacker distributes or controls a Flatpak application that has been granted D-Bus session access to evolution-data-server. The application calls the EDS D-Bus API to create or modify a contact, supplying a URI such as 'file:///home/user/.local/share/flatpak/overrides/../../../../.local/share/flatpak/overrides/com.example.App' containing traversal sequences that pass the creation-time validation check. When the victim subsequently deletes the manipulated contact through any EDS-integrated application (e.g., GNOME Contacts), the deletion-time path check fails to reject the traversal, and the targeted Flatpak override file is silently removed from the host filesystem - potentially widening the sandbox permissions of other Flatpak applications on subsequent launch.