CVE-2026-2604

Name	CVE-2026-2604
Description	A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4503-1
Debian Bugs	1128332

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
evolution-data-server (PTS)	bullseye	3.38.3-1+deb11u2	vulnerable
	bullseye (security)	3.38.3-1+deb11u3	fixed
	bookworm	3.46.4-2	vulnerable
	trixie	3.56.2-0+deb13u1	vulnerable
	forky, sid	3.56.2-8	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
evolution-data-server	source	bullseye	3.38.3-1+deb11u3		DLA-4503-1
evolution-data-server	source	(unstable)	3.56.2-8			1128332

Notes

https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/627
Fixed by: https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/afa12b6ba502e5acaa431415aa3b939ddb377382