CVE-2026-111802

Received Received - Intake

Nautilus Trash Deletion via Symbolic Link Attack

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: redhat-SADP

Description

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-111802

EUVD

EUVD-2026-103191

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Nautilus, a file manager for Linux. When a user unmounts or ejects a removable drive or disk image, Nautilus may prompt to empty the trash without checking if trash directory paths are symbolic links. An attacker can exploit this by creating a malicious storage volume that, when mounted and the prompt is confirmed, causes arbitrary file deletion for the user.

Detection Guidance

This vulnerability involves Nautilus prompting users to empty trash without checking if trash directory paths are symbolic links. To detect it, monitor for unexpected file deletions after unmounting removable drives or disk images. Check Nautilus logs for trash-related prompts during unmount operations. No specific commands are provided in the context.

Impact Analysis

This flaw could lead to unintended data loss. If you confirm the trash emptying prompt on a malicious volume, files accessible to your user account may be deleted without your knowledge. It requires user interaction but could affect personal files, documents, or other data stored on the system.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized file deletion. If exploited, it may lead to data integrity issues or loss of sensitive user data, which are critical concerns under these regulations. However, the specific impact depends on the affected system's data handling and protection measures.

Mitigation Strategies

Update Nautilus to the latest version to patch the flaw. Avoid mounting untrusted removable drives or disk images. Disable automatic trash emptying prompts for removable media in Nautilus settings.

Hi! I’m here to help you understand CVE-2026-111802. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70