CVE-2026-111802
Description
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.
Statement
This vulnerability is rated as Low impact for Red Hat Enterprise Linux because exploitation requires local user interaction with an untrusted storage volume or virtual image within an active graphical desktop session. Nautilus is not utilized in headless server installations, which represent the standard deployment model for enterprise environments. Furthermore, an attack can only succeed if the user unmounts the volume and confirms the trash deletion dialog, limiting potential destruction strictly to files accessible under that specific user's filesystem permissions without providing privilege escalation or code execution.
Mitigation
Mitigation if available: Do not choose "Empty" or remove the ability to "Empty Trash" upon ejecting USB devices
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.6 | N/A | 6.6 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Acknowledgements
Red Hat would like to thank Corey Berla for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
