Summary: When a mount is unmounted or ejected, Nautilus offers to empty its trash. It deleted the contents of .Trash-$uid/files and .Trash-$uid/info (and .Trash/$uid/...) without checking for symbolic links. A crafted disk image or device that makes these paths symlinks to e.g. the user's home directory causes Nautilus to recursively delete the link target when the user chooses "Empty", which is the dialog's default action.

Requirements to exploit: A crafted disk image (i.e. ISO) or external device (i.e. USB). No access to the system is required

Component affected: nautilus

Version affected: All versions since 2.21

Patch available: Yes

Version fixed (if any already): PR available now 

Upstream coordination: https://gitlab.gnome.org/GNOME/nautilus/-/merge_requests/2179 

CVSS (optional): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Impact (optional): Arbitrary deletion of any files the user can write, including the entire home directory.

Embargo: No

Acknowledgment: Corey Berla

Steps to reproduce if available: 

1. Create an image containing a symlink .Trash-1000/files -> /home/<user> (or another directory)
(e.g. xorriso -as mkisofs -R).
2. The user mounts the image (e.g. "Open With → Disk Image Mounter").
3. The user ejects it from Nautilus and chooses "Empty" (the default action).
4. The contents of the link target are deleted.

Mitigation if available: Do not choose "Empty" or remove the ability to "Empty Trash" upon ejecting USB devices