p PatchFirst

CVE-2026-2604

CVE-2026-2604 · Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.

CVSS 5.6 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • evolution data server

    Versions
    • ≥ 0, < 3.59.3: Affected (semver)

    Update to 3.59.3

  • red hat enterprise linux 10

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • evolution-data-server Debian:12

    Versions
    • 3.46.4-2
    Affected ranges
    • ECOSYSTEM: < 3.46.4-2+deb12u1

    Update to 3.46.4-2+deb12u1

  • evolution-data-server Debian:13

    Versions
    • 3.56.1-2
    • 3.56.2-0+deb13u1
    • 3.56.2-1
    • 3.56.2-2
    • 3.56.2-3
    • 3.56.2-4
    • 3.56.2-5
    • 3.56.2-6
    • 3.56.2-7
    • 3.56.2-8
    • 3.56.2-9
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • evolution-data-server Debian:14

    Versions
    • 3.56.1-2
    • 3.56.2-1
    • 3.56.2-2
    • 3.56.2-3
    • 3.56.2-4
    • 3.56.2-5
    • 3.56.2-6
    • 3.56.2-7
    Affected ranges
    • ECOSYSTEM: < 3.56.2-8

    Update to 3.56.2-8

  • evolution-data-server Ubuntu:Pro:18.04:LTS

    Versions
    • 3.26.1-1ubuntu1
    • 3.26.2-1ubuntu1
    • 3.26.2.1-1ubuntu1
    • 3.26.2.1-1ubuntu3
    • 3.26.3-1ubuntu1
    • 3.26.5-1ubuntu3
    • 3.27.90-1ubuntu1
    • 3.28.0-1ubuntu1
    • 3.28.0-2ubuntu1
    • 3.28.0-2ubuntu2
    • 3.28.1-1ubuntu1
    • 3.28.3-0ubuntu0.18.04.1
    • 3.28.5-0ubuntu0.18.04.1
    • 3.28.5-0ubuntu0.18.04.2
    • 3.28.5-0ubuntu0.18.04.3
    Affected ranges
    • ECOSYSTEM: < 3.28.5-0ubuntu0.18.04.3+esm1

    Update to 3.28.5-0ubuntu0.18.04.3+esm1

  • evolution-data-server Ubuntu:Pro:20.04:LTS

    Versions
    • 3.34.1-1
    • 3.34.1-1build1
    • 3.34.1-1ubuntu1
    • 3.34.1-2
    • 3.34.3-2
    • 3.35.91-1
    • 3.35.92-1
    • 3.36.0-1
    • 3.36.1-1
    • 3.36.1-2
    • 3.36.2-0ubuntu1
    • 3.36.3-0ubuntu1
    • 3.36.3-0ubuntu1.1
    • 3.36.4-0ubuntu1
    • 3.36.5-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 3.36.5-0ubuntu1+esm1

    Update to 3.36.5-0ubuntu1+esm1

  • evolution-data-server Ubuntu:22.04:LTS

    Versions
    • 3.40.4-1
    • 3.42.0-2
    • 3.42.1-1
    • 3.42.2-1
    • 3.42.3-1
    • 3.42.4-1
    • 3.43.3-1
    • 3.44.0-2
    • 3.44.1-0ubuntu2
    • 3.44.2-0ubuntu1
    • 3.44.4-0ubuntu1
    • 3.44.4-0ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 3.44.4-0ubuntu1.2

    Update to 3.44.4-0ubuntu1.2

  • evolution-data-server Ubuntu:24.04:LTS

    Versions
    • 3.50.0-1
    • 3.50.1-1
    • 3.50.2-1
    • 3.50.2-1build1
    • 3.50.3-1
    • 3.52.0-1build1
    • 3.52.0-1build2
    • 3.52.0-1build3
    • 3.52.3-0ubuntu1
    • 3.52.3-0ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 3.52.3-0ubuntu1.2

    Update to 3.52.3-0ubuntu1.2

  • evolution-data-server Ubuntu:25.10

    Versions
    • 3.56.0-1
    • 3.56.1-2
    • 3.56.1-2build1
    • 3.56.2-1
    • 3.56.2-3
    Affected ranges
    • ECOSYSTEM: < 3.56.2-3ubuntu0.1

    Update to 3.56.2-3ubuntu0.1

Original sources

Check your server →