{"id":"UBUNTU-CVE-2026-2604","details":"A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.","modified":"2026-06-24T11:01:29.245800963Z","published":"2026-02-18T00:00:00Z","related":["USN-8055-1","USN-8055-2"],"upstream":["CVE-2026-2604"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-2604"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-2604"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8055-1"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8055-2"}],"affected":[{"package":{"name":"evolution-data-server","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/evolution-data-server?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.5-0ubuntu0.18.04.3+esm1"}]}],"versions":["3.26.1-1ubuntu1","3.26.2-1ubuntu1","3.26.2.1-1ubuntu1","3.26.2.1-1ubuntu3","3.26.3-1ubuntu1","3.26.5-1ubuntu3","3.27.90-1ubuntu1","3.28.0-1ubuntu1","3.28.0-2ubuntu1","3.28.0-2ubuntu2","3.28.1-1ubuntu1","3.28.3-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.2","3.28.5-0ubuntu0.18.04.3"],"ecosystem_specific":{"binaries":[{"binary_name":"evolution-data-server","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"evolution-data-server-common","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_version":"3.28.5-0ubuntu0.18.04.3+esm1","binary_name":"evolution-data-server-online-accounts"},{"binary_name":"evolution-data-server-tests","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"gir1.2-camel-1.2","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"gir1.2-ebook-1.2","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"gir1.2-ebookcontacts-1.2","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"gir1.2-edataserver-1.2","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"gir1.2-edataserverui-1.2","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"libcamel-1.2-61","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_version":"3.28.5-0ubuntu0.18.04.3+esm1","binary_name":"libebackend-1.2-10"},{"binary_name":"libebook-1.2-19","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"libebook-contacts-1.2-2","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_version":"3.28.5-0ubuntu0.18.04.3+esm1","binary_name":"libecal-1.2-19"},{"binary_name":"libedata-book-1.2-25","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_name":"libedata-cal-1.2-28","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"},{"binary_version":"3.28.5-0ubuntu0.18.04.3+esm1","binary_name":"libedataserver-1.2-23"},{"binary_name":"libedataserverui-1.2-2","binary_version":"3.28.5-0ubuntu0.18.04.3+esm1"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-2604.json"}},{"package":{"name":"evolution-data-server","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/evolution-data-server?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.5-0ubuntu1+esm1"}]}],"versions":["3.34.1-1","3.34.1-1build1","3.34.1-1ubuntu1","3.34.1-2","3.34.3-2","3.35.91-1","3.35.92-1","3.36.0-1","3.36.1-1","3.36.1-2","3.36.2-0ubuntu1","3.36.3-0ubuntu1","3.36.3-0ubuntu1.1","3.36.4-0ubuntu1","3.36.5-0ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"evolution-data-server"},{"binary_name":"evolution-data-server-common","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"evolution-data-server-tests"},{"binary_name":"gir1.2-camel-1.2","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"gir1.2-ebackend-1.2"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"gir1.2-ebook-1.2"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"gir1.2-ebookcontacts-1.2"},{"binary_name":"gir1.2-ecal-2.0","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"gir1.2-edatabook-1.2"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"gir1.2-edatacal-2.0"},{"binary_name":"gir1.2-edataserver-1.2","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_name":"gir1.2-edataserverui-1.2","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"libcamel-1.2-62"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"libebackend-1.2-10"},{"binary_name":"libebook-1.2-20","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"libebook-contacts-1.2-3"},{"binary_name":"libecal-2.0-1","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_name":"libedata-book-1.2-26","binary_version":"3.36.5-0ubuntu1+esm1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"libedata-cal-2.0-1"},{"binary_version":"3.36.5-0ubuntu1+esm1","binary_name":"libedataserver-1.2-24"},{"binary_name":"libedataserverui-1.2-2","binary_version":"3.36.5-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-2604.json"}},{"package":{"name":"evolution-data-server","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/evolution-data-server?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.44.4-0ubuntu1.2"}]}],"versions":["3.40.4-1","3.42.0-2","3.42.1-1","3.42.2-1","3.42.3-1","3.42.4-1","3.43.3-1","3.44.0-2","3.44.1-0ubuntu2","3.44.2-0ubuntu1","3.44.4-0ubuntu1","3.44.4-0ubuntu1.1"],"ecosystem_specific":{"binaries":[{"binary_name":"evolution-data-server","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"evolution-data-server-common","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"evolution-data-server-tests","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"gir1.2-camel-1.2","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"gir1.2-ebackend-1.2","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"gir1.2-ebook-1.2","binary_version":"3.44.4-0ubuntu1.2"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"gir1.2-ebookcontacts-1.2"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"gir1.2-ecal-2.0"},{"binary_name":"gir1.2-edatabook-1.2","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"gir1.2-edatacal-2.0","binary_version":"3.44.4-0ubuntu1.2"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"gir1.2-edataserver-1.2"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"gir1.2-edataserverui-1.2"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"libcamel-1.2-63"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"libebackend-1.2-10"},{"binary_name":"libebook-1.2-20","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"libebook-contacts-1.2-3","binary_version":"3.44.4-0ubuntu1.2"},{"binary_version":"3.44.4-0ubuntu1.2","binary_name":"libecal-2.0-1"},{"binary_name":"libedata-book-1.2-26","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"libedata-cal-2.0-1","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"libedataserver-1.2-26","binary_version":"3.44.4-0ubuntu1.2"},{"binary_name":"libedataserverui-1.2-3","binary_version":"3.44.4-0ubuntu1.2"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-2604.json"}},{"package":{"name":"evolution-data-server","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/evolution-data-server?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.52.3-0ubuntu1.2"}]}],"versions":["3.50.0-1","3.50.1-1","3.50.2-1","3.50.2-1build1","3.50.3-1","3.52.0-1build1","3.52.0-1build2","3.52.0-1build3","3.52.3-0ubuntu1","3.52.3-0ubuntu1.1"],"ecosystem_specific":{"binaries":[{"binary_name":"evolution-data-server","binary_version":"3.52.3-0ubuntu1.2"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"evolution-data-server-common"},{"binary_name":"evolution-data-server-tests","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"gir1.2-camel-1.2","binary_version":"3.52.3-0ubuntu1.2"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"gir1.2-ebackend-1.2"},{"binary_name":"gir1.2-ebook-1.2","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"gir1.2-ebookcontacts-1.2","binary_version":"3.52.3-0ubuntu1.2"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"gir1.2-ecal-2.0"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"gir1.2-edatabook-1.2"},{"binary_name":"gir1.2-edatacal-2.0","binary_version":"3.52.3-0ubuntu1.2"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"gir1.2-edataserver-1.2"},{"binary_name":"gir1.2-edataserverui-1.2","binary_version":"3.52.3-0ubuntu1.2"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"gir1.2-edataserverui4-1.0"},{"binary_name":"libcamel-1.2-64t64","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"libebackend-1.2-11t64","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"libebook-1.2-21t64","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"libebook-contacts-1.2-4t64","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"libecal-2.0-3","binary_version":"3.52.3-0ubuntu1.2"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"libedata-book-1.2-27t64"},{"binary_name":"libedata-cal-2.0-2t64","binary_version":"3.52.3-0ubuntu1.2"},{"binary_name":"libedataserver-1.2-27t64","binary_version":"3.52.3-0ubuntu1.2"},{"binary_version":"3.52.3-0ubuntu1.2","binary_name":"libedataserverui-1.2-4t64"},{"binary_name":"libedataserverui4-1.0-0t64","binary_version":"3.52.3-0ubuntu1.2"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-2604.json"}},{"package":{"name":"evolution-data-server","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/evolution-data-server?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.56.2-3ubuntu0.1"}]}],"versions":["3.56.0-1","3.56.1-2","3.56.1-2build1","3.56.2-1","3.56.2-3"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"evolution-data-server","binary_version":"3.56.2-3ubuntu0.1"},{"binary_name":"evolution-data-server-common","binary_version":"3.56.2-3ubuntu0.1"},{"binary_version":"3.56.2-3ubuntu0.1","binary_name":"evolution-data-server-tests"},{"binary_name":"gir1.2-camel-1.2","binary_version":"3.56.2-3ubuntu0.1"},{"binary_name":"gir1.2-ebackend-1.2","binary_version":"3.56.2-3ubuntu0.1"},{"binary_name":"gir1.2-ebook-1.2","binary_version":"3.56.2-3ubuntu0.1"},{"binary_version":"3.56.2-3ubuntu0.1","binary_name":"gir1.2-ebookcontacts-1.2"},{"binary_name":"gir1.2-ecal-2.0","binary_version":"3.56.2-3ubuntu0.1"},{"binary_name":"gir1.2-edatabook-1.2","binary_version":"3.56.2-3ubuntu0.1"},{"binary_version":"3.56.2-3ubuntu0.1","binary_name":"gir1.2-edatacal-2.0"},{"binary_name":"gir1.2-edataserver-1.2","binary_version":"3.56.2-3ubuntu0.1"},{"binary_version":"3.56.2-3ubuntu0.1","binary_name":"gir1.2-edataserverui-1.2"},{"binary_name":"gir1.2-edataserverui4-1.0","binary_version":"3.56.2-3ubuntu0.1"},{"binary_version":"3.56.2-3ubuntu0.1","binary_name":"libcamel-1.2-64t64"},{"binary_name":"libebackend-1.2-11t64","binary_version":"3.56.2-3ubuntu0.1"},{"binary_name":"libebook-1.2-21t64","binary_version":"3.56.2-3ubuntu0.1"},{"binary_name":"libebook-contacts-1.2-4t64","binary_version":"3.56.2-3ubuntu0.1"},{"binary_version":"3.56.2-3ubuntu0.1","binary_name":"libecal-2.0-3"},{"binary_name":"libedata-book-1.2-27t64","binary_version":"3.56.2-3ubuntu0.1"},{"binary_version":"3.56.2-3ubuntu0.1","binary_name":"libedata-cal-2.0-2t64"},{"binary_version":"3.56.2-3ubuntu0.1","binary_name":"libedataserver-1.2-27t64"},{"binary_name":"libedataserverui-1.2-4t64","binary_version":"3.56.2-3ubuntu0.1"},{"binary_version":"3.56.2-3ubuntu0.1","binary_name":"libedataserverui4-1.0-0t64"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-2604.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L"},{"type":"Ubuntu","score":"medium"}]}