Live › vulnerability › CVE-2026-111802
Go to dashboardWhen a removable drive or disk image is unmounted or ejected, Nautilus asks the user to empty the trash without checking whether the trash directory is a symbolic link. A crafted volume can make confirming that prompt delete arbitrary files the user can access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Desktop users of the GNOME Nautilus file manager who mount removable drives or disk images from untrusted sources. Servers and users who never mount external media are unlikely to be exposed. The sources do not name the affected Nautilus versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.
This page as .md · .json · in your agent: get_signal("CVE-2026-111802")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.