PGV-2676808

Disclosed on October 17, 2026 (updated October 17, 2026)

Vulnerability Overview

PGV-2676808 is a category 1 vulnerabilty that affects the following packages:

debian/nautilus source, bookworm, versions (all)
debian/nautilus source, forky, versions (all)
debian/nautilus source, trixie, versions (all)

CVSS Score: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H)

Risk Assessment

The risk assessment shows that this vulnerability is exlpoited by a rogue user. A legitimate user who abuses authorized access to exploit this vulnerability.

The impact is contained to the application. Exploitation remains confined to the application and cannot affect the host environment or external systems.

The threat damage is caused by a denial of service. Exploitation can completely deny access to the application, resulting in a full outage.is caused by data tampering. Exploitation can result in modification of any data (authorized or not) within the system.

Vulnerability Details

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.

Common Weakness Enumerations

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Additional References

Your Risk Profile

Network Exposure	External Accessable from the public internet
Access Interface	WebBrowser Primarily web-based applications
Service Outage	Disruptive Operations would be impacted
Data Breach	Disruptive Operations would be impacted
Data Tampering	Disruptive Operations would be impacted
Customize

Additional Identifiers

DEBIAN-CVE-2026-111802