Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-2604
GNOME Evolution Data Server — Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L R U N H L 5.6 .0028 18.7 —
AFFECTED
Product Versions Fixed
Evolution Data Server unspecified —
Red Hat Enterprise Linux 10 unspecified —
Red Hat Enterprise Linux 6 unspecified —
Red Hat Enterprise Linux 7 unspecified —
Red Hat Enterprise Linux 8 unspecified —
Red Hat Enterprise Linux 9 unspecified —
TIMELINE
Feb 16 Reserved by redhat
Jun 16 Published (CNA: redhat)
Sep 25 EXPLOIT PUBLISHED — CVE-2026-2604 (GNOME Evolution Data Server). Public exploit reference added.
Description
A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| February 16, 2026 | Reserved | Reserved by redhat |
| June 16, 2026 | Published | Published (CNA: redhat) |
| September 25, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-2604 (GNOME Evolution Data Server). Public exploit reference added. |
Affected
Affected products and packages — 6 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| GNOME | Evolution Data Server | — | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-2604 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
