{"id":"CVE-2026-111802","kind":"vulnerability","aliases":["CVE-2026-111802"],"related":[],"title":"Nautilus: symlinked trash on unmounted drive can delete user files","description":"A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.","summary":"When a removable drive or disk image is unmounted or ejected, Nautilus asks the user to empty the trash without checking whether the trash directory is a symbolic link. A crafted volume can make confirming that prompt delete arbitrary files the user can access.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gnome","linux-desktop","nautilus","other"],"not_affected_if":["headless-server","no-removable-media"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T23:17:01+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:47:00+00:00","updated_at":"2026-10-25T03:47:00+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:47:00Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Nautilus: symlinked trash on unmounted drive can delete user files","impact":"medium","summary":"When a removable drive or disk image is unmounted or ejected, Nautilus asks the user to empty the trash without checking whether the trash directory is a symbolic link. A crafted volume can make confirming that prompt delete arbitrary files the user can access.","category":"other","nicknames":[],"who_cares":["nautilus","gnome","linux-desktop"],"confidence":0.6,"needs_auth":"no","worst_case":"Arbitrary files the logged-in user can access get deleted.","analyst_note":"Find the affected and fixed Nautilus versions and the upstream fix commit, using the NVD entry linked in the sources.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-removable-media","headless-server"],"who_is_affected":"Desktop users of the GNOME Nautilus file manager who mount removable drives or disk images from untrusted sources. Servers and users who never mount external media are unlikely to be exposed. The sources do not name the affected Nautilus versions.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00055,"input_tokens":3327,"output_tokens":434,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111802':13A,16A '-2026':12A,15A 'access':65B,132C 'arbitrari':60B,128C 'ask':34B 'attack':102C 'check':42B 'confirm':56B,118C 'craft':52B,114C 'cve':11A,14A 'delet':8A,59B,129C 'desktop':20B 'directori':46B,96C 'disk':27B,77C 'drive':6A,25B,75C 'eject':32B,82C 'empti':38B,88C,122C 'exploit':104C 'file':10A,61B,131C 'flaw':67C,106C 'found':69C 'gnome':17B 'imag':28B,78C 'lead':125C 'link':50B,100C 'linux':19B 'linux-desktop':18B 'make':55B 'mount':112C 'nautilus':1A,21B,33B,71C,83C 'path':97C 'prompt':58B,84C,120C 'remov':24B,74C 'storag':115C 'symbol':49B,99C 'symlink':2A 'trash':3A,40B,45B,90C,95C,124C 'trick':108C 'unmount':5A,30B,80C 'user':9A,36B,63B,86C,110C,135C 'verifi':92C 'volum':53B,116C 'whether':43B,93C 'without':41B,91C","nicknames":[],"mitigations":[],"who_affected":"Desktop users of the GNOME Nautilus file manager who mount removable drives or disk images from untrusted sources. Servers and users who never mount external media are unlikely to be exposed. The sources do not name the affected Nautilus versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T23:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111802","severity":null,"published_at":"2026-10-16T23:17:01+00:00","modified_at":"2026-10-21T22:16:47+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}