CVE catalog

CVE-2026-111802

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symboli

[CVE catalog]

Severity
Medium · CVSS 6.6CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.16% · Oct 25, 2026

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannautilussid51.0.1-3vulnerable
Debiannautilusforky51.0.1-3vulnerable
Debiannautilustrixie48.3-2vulnerable
Debiannautilusbookworm43.2-1vulnerable
Ubuntunautilus16.041:3.14.2-0ubuntu12vulnerable
Ubuntunautilus16.041:3.14.2-0ubuntu14vulnerable
Ubuntunautilus16.041:3.14.2-0ubuntu15vulnerable
Ubuntunautilus16.041:3.18.2-1ubuntu1vulnerable
Ubuntunautilus16.041:3.18.2-1ubuntu2vulnerable
Ubuntunautilus16.041:3.18.2-1ubuntu3vulnerable
Ubuntunautilus16.041:3.18.3-0ubuntu1vulnerable
Ubuntunautilus16.041:3.18.4-0ubuntu1vulnerable
Ubuntunautilus16.041:3.18.4-0ubuntu2vulnerable
Ubuntunautilus16.041:3.18.4.is.3.14.3-0ubuntu1vulnerable
Ubuntunautilus16.041:3.18.4.is.3.14.3-0ubuntu2vulnerable
Ubuntunautilus16.041:3.18.4.is.3.14.3-0ubuntu3vulnerable
Ubuntunautilus16.041:3.18.4.is.3.14.3-0ubuntu4vulnerable
Ubuntunautilus16.041:3.18.4.is.3.14.3-0ubuntu5vulnerable
Ubuntunautilus16.041:3.18.4.is.3.14.3-0ubuntu6vulnerable
Ubuntunautilus18.041:3.26.0-0ubuntu1vulnerable
Ubuntunautilus18.041:3.26.2-0ubuntu1vulnerable
Ubuntunautilus18.041:3.26.2-0ubuntu3.1vulnerable
Ubuntunautilus18.041:3.26.3-0ubuntu1vulnerable
Ubuntunautilus18.041:3.26.3-0ubuntu2vulnerable
Ubuntunautilus18.041:3.26.3-0ubuntu3vulnerable
Ubuntunautilus18.041:3.26.3-0ubuntu4vulnerable
Ubuntunautilus18.041:3.26.4-0~ubuntu18.04.1vulnerable
Ubuntunautilus18.041:3.26.4-0~ubuntu18.04.2vulnerable
Ubuntunautilus18.041:3.26.4-0~ubuntu18.04.3vulnerable
Ubuntunautilus18.041:3.26.4-0~ubuntu18.04.4vulnerable
Ubuntunautilus18.041:3.26.4-0~ubuntu18.04.5vulnerable
Ubuntunautilus18.041:3.26.4-0~ubuntu18.04.6vulnerable
Ubuntunautilus20.041:3.34.1-1ubuntu1vulnerable
Ubuntunautilus20.041:3.35.90-1ubuntu2vulnerable
Ubuntunautilus20.041:3.35.92-1ubuntu1vulnerable
Ubuntunautilus20.041:3.36.0-1ubuntu1vulnerable
Ubuntunautilus20.041:3.36.1-1ubuntu1vulnerable
Ubuntunautilus20.041:3.36.1.1-1ubuntu1vulnerable
Ubuntunautilus20.041:3.36.1.1-1ubuntu2vulnerable
Ubuntunautilus20.041:3.36.2-0ubuntu1vulnerable
Ubuntunautilus20.041:3.36.3-0ubuntu1vulnerable
Ubuntunautilus20.041:3.36.3-0ubuntu1.20.04.1vulnerable
Ubuntunautilus20.041:3.36.3-0ubuntu1.20.04.2vulnerable
Ubuntunautilus22.041:40.2-1ubuntu1vulnerable
Ubuntunautilus22.041:41.1-1ubuntu1vulnerable
Ubuntunautilus22.041:41.2-1ubuntu1vulnerable
Ubuntunautilus22.041:42~beta-1ubuntu1vulnerable
Ubuntunautilus22.041:42~rc-1ubuntu1vulnerable
Ubuntunautilus22.041:42.0-1ubuntu2vulnerable
Ubuntunautilus22.041:42.1.1-0ubuntu1vulnerable
Ubuntunautilus22.041:42.2-0ubuntu1vulnerable
Ubuntunautilus22.041:42.2-0ubuntu2vulnerable
Ubuntunautilus22.041:42.2-0ubuntu2.1vulnerable
Ubuntunautilus22.041:42.6-0ubuntu1vulnerable
Ubuntunautilus22.041:42.6-0ubuntu2vulnerable
Ubuntunautilus24.041:45~rc-1ubuntu1vulnerable
Ubuntunautilus24.041:45.2.1-4ubuntu1vulnerable
Ubuntunautilus24.041:46~beta-0ubuntu3vulnerable
Ubuntunautilus24.041:46.0-0ubuntu1vulnerable
Ubuntunautilus24.041:46.0-0ubuntu2vulnerable
Ubuntunautilus24.041:46.1-0ubuntu1vulnerable
Ubuntunautilus24.041:46.2-0ubuntu0.1vulnerable
Ubuntunautilus24.041:46.2-0ubuntu0.2vulnerable
Ubuntunautilus24.041:46.2-0ubuntu0.3vulnerable
Ubuntunautilus24.041:46.4-0ubuntu0.1vulnerable
Ubuntunautilus24.041:46.4-0ubuntu0.2vulnerable
Ubuntunautilus26.101:50.0-0ubuntu2vulnerable
Ubuntunautilus26.101:50.1-2ubuntu1vulnerable
Ubuntunautilus26.101:50.1-2ubuntu2vulnerable
Ubuntunautilus26.101:51~alpha-0ubuntu1vulnerable
Ubuntunautilus26.101:51~rc-0ubuntu1vulnerable
Ubuntunautilus26.101:51.0.1-0ubuntu2vulnerable
Ubuntunautilus26.101:51.0.1-0ubuntu3vulnerable
Ubuntunautilus26.041:49.0-1ubuntu2vulnerable
Ubuntunautilus26.041:49.1-2ubuntu2vulnerable
Ubuntunautilus26.041:49.1-2ubuntu3vulnerable
Ubuntunautilus26.041:50~alpha-0ubuntu2vulnerable
Ubuntunautilus26.041:50~beta-0ubuntu1vulnerable
Ubuntunautilus26.041:50~rc-0ubuntu1vulnerable
Ubuntunautilus26.041:50.0-0ubuntu1vulnerable
Ubuntunautilus26.041:50.0-0ubuntu2vulnerable
Ubuntunautilus26.041:50.2.2-0ubuntu0.1vulnerable
Ubuntunautilus26.041:50.2.2-0ubuntu0.2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannautilussourcesid(unfixed)not yet assignedNot reportedNot reported
Debiannautilussourceforky(unfixed)not yet assignedNot reportedNot reported
Debiannautilussourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiannautilussourcebookworm(unfixed)not yet assignedNot reportedNot reported

Notes

[trixie] nautilus: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gir1.2-nautilus-4.0]Affected

    Source package: [nautilus]

    Details (2)

    • 43.2-1 · amd64 · bookworm

      Affected

      nvd · nautilus · debian · bookworm; nvd · nautilus · debian · 12

    • 43.2-1 · arm64 · bookworm

      Affected

      nvd · nautilus · debian · bookworm; nvd · nautilus · debian · 12

  • [libnautilus-extension4]Affected

    Source package: [nautilus]

    Details (2)

    • 43.2-1 · amd64 · bookworm

      Affected

      nvd · nautilus · debian · bookworm; nvd · nautilus · debian · 12

    • 43.2-1 · arm64 · bookworm

      Affected

      nvd · nautilus · debian · bookworm; nvd · nautilus · debian · 12

  • [libnautilus-extension-dev]Affected

    Source package: [nautilus]

    Details (2)

    • 43.2-1 · amd64 · bookworm

      Affected

      nvd · nautilus · debian · bookworm; nvd · nautilus · debian · 12

    • 43.2-1 · arm64 · bookworm

      Affected

      nvd · nautilus · debian · bookworm; nvd · nautilus · debian · 12

  • [nautilus]Affected
    Details (2)

    • 43.2-1 · amd64 · bookworm

      Affected

      nvd · nautilus · debian · bookworm; nvd · nautilus · debian · 12

    • 43.2-1 · arm64 · bookworm

      Affected

      nvd · nautilus · debian · bookworm; nvd · nautilus · debian · 12

  • [nautilus-data]Affected

    Source package: [nautilus]

    Details (2)

    • 43.2-1 · all · bookworm

      Affected

      nvd · nautilus · debian · bookworm; nvd · nautilus · debian · 12

    • 43.2-1 · all · bookworm

      Affected

      nvd · nautilus · debian · bookworm; nvd · nautilus · debian · 12

[Debian 13 (Trixie)]

  • [gir1.2-nautilus-4.0]Affected

    Source package: [nautilus]

    Details (2)

    • 48.3-2 · amd64 · trixie

      Affected

      nvd · nautilus · debian · 13

    • 48.3-2 · arm64 · trixie

      Affected

      nvd · nautilus · debian · 13

  • [libnautilus-extension4]Affected

    Source package: [nautilus]

    Details (2)

    • 48.3-2 · amd64 · trixie

      Affected

      nvd · nautilus · debian · 13

    • 48.3-2 · arm64 · trixie

      Affected

      nvd · nautilus · debian · 13

  • [libnautilus-extension-dev]Affected

    Source package: [nautilus]

    Details (2)

    • 48.3-2 · amd64 · trixie

      Affected

      nvd · nautilus · debian · 13

    • 48.3-2 · arm64 · trixie

      Affected

      nvd · nautilus · debian · 13

  • [nautilus]Affected
    Details (2)

    • 48.3-2 · amd64 · trixie

      Affected

      nvd · nautilus · debian · 13

    • 48.3-2 · arm64 · trixie

      Affected

      nvd · nautilus · debian · 13

  • [nautilus-data]Affected

    Source package: [nautilus]

    Details (2)

    • 48.3-2 · all · trixie

      Affected

      nvd · nautilus · debian · 13

    • 48.3-2 · all · trixie

      Affected

      nvd · nautilus · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]