---
id: "CVE-2026-111802"
kind: "vulnerability"
aliases: ["CVE-2026-111802"]
title: "Nautilus: symlinked trash on unmounted drive can delete user files"
severity: "medium"
cvss: 6.6
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["gnome", "linux-desktop", "nautilus", "other"]
not_affected_if: ["headless-server", "no-removable-media"]
published_at: "2026-10-16T23:17:01+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:47:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111802", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Nautilus: symlinked trash on unmounted drive can delete user files

When a removable drive or disk image is unmounted or ejected, Nautilus asks the user to empty the trash without checking whether the trash directory is a symbolic link. A crafted volume can make confirming that prompt delete arbitrary files the user can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111802

## From the sources

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_