https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:42:05 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-377165 EUVD-2026-377165 https://cve.radiocsirt.org/vuln/euvd-2026-377165 https://cve.radiocsirt.org/vuln/fkie_cve-2026-2604 <p>A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.</p> <p>A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-2604 https://cve.radiocsirt.org/vuln/ghsa-9h57-x6hw-v4j8 <p>A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.</p> <p>A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.</p> https://cve.radiocsirt.org/vuln/ghsa-9h57-x6hw-v4j8 https://cve.radiocsirt.org/vuln/oesa-2026-2354 <p><strong>Affected:</strong> openEuler:24.03-LTS: evolution-data-server</p> <p>The evolution-data-server package provides a personal information management application that provides integrated mail, calendaring and address book functionality. The evolution-data-server package provides a single database for common, desktop-wide information, such as a user&amp;amp;apos;s address book or calendar events. Security Fix(es):</p> <p>A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.(CVE-2026-2604)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: evolution-data-server</p> <p>The evolution-data-server package provides a personal information management application that provides integrated mail, calendaring and address book functionality. The evolution-data-server package provides a single database for common, desktop-wide information, such as a user&amp;amp;apos;s address book or calendar events. Security Fix(es):</p> <p>A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.(CVE-2026-2604)</p> https://cve.radiocsirt.org/vuln/oesa-2026-2354 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10262-1 <p>evolution-data-server-3.58.3-2.1 on GA media</p> <p>evolution-data-server-3.58.3-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10262-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-2604 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: evolution-data-server, Ubuntu:Pro:20.04:LTS: evolution-data-server, Ubuntu:22.04:LTS: evolution-data-server, Ubuntu:24.04:LTS: evolution-data-server, Ubuntu:25.10: evolution-data-server</p> <p>A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: evolution-data-server, Ubuntu:Pro:20.04:LTS: evolution-data-server, Ubuntu:22.04:LTS: evolution-data-server, Ubuntu:24.04:LTS: evolution-data-server, Ubuntu:25.10: evolution-data-server</p> <p>A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-2604