Bug 2554410 (CVE-2026-111802)

Summary: CVE-2026-111802 nautilus: nautilus: Arbitrary File Deletion via Trash Symlink
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-16 19:49:49 UTC 
Summary: When a mount is unmounted or ejected, Nautilus offers to empty its trash. It deleted the contents of .Trash-$uid/files and .Trash-$uid/info (and .Trash/$uid/...) without checking for symbolic links. A crafted disk image or device that makes these paths symlinks to e.g. the user's home directory causes Nautilus to recursively delete the link target when the user chooses "Empty", which is the dialog's default action.

Requirements to exploit: A crafted disk image (i.e. ISO) or external device (i.e. USB). No access to the system is required

Component affected: nautilus

Version affected: All versions since 2.21

Patch available: Yes

Version fixed (if any already): PR available now 

Upstream coordination: https://gitlab.gnome.org/GNOME/nautilus/-/merge_requests/2179 

CVSS (optional): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Impact (optional): Arbitrary deletion of any files the user can write, including the entire home directory.

Embargo: No

Acknowledgment: Corey Berla

Steps to reproduce if available: 

1. Create an image containing a symlink .Trash-1000/files -> /home/<user> (or another directory)
(e.g. xorriso -as mkisofs -R).
2. The user mounts the image (e.g. "Open With → Disk Image Mounter").
3. The user ejects it from Nautilus and chooses "Empty" (the default action).
4. The contents of the link target are deleted.

Mitigation if available: Do not choose "Empty" or remove the ability to "Empty Trash" upon ejecting USB devices