CVE-2026-111802: Nautilus: nautilus: arbitrary file deletion via trash symlink
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.
Other sources
Summary: When a mount is unmounted or ejected, Nautilus offers to empty its trash. It deleted the contents of .Trash-$uid/files and .Trash-$uid/info (and .Trash/$uid/...) without checking for symbolic links. A crafted disk image or device that makes these paths symlinks to e.g. the user's home directory causes Nautilus to recursively delete the link target when the user chooses "Empty", which is the dialog's default action.
Requirements to exploit: A crafted disk image (i.e. ISO) or external device (i.e. USB). No access to the system is required
Component affected: nautilus
Version affected: All versions since 2.21
Patch available: Yes
Version fixed (if any already): PR available now
Upstream coordination: https://gitlab.gnome.org/GNOME/nautilus/-/mergerequests/2179
CVSS (optional): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Impact (optional): Arbitrary deletion of any files the user can write, including the entire home directory.
Embargo: No
Acknowledgment: Corey Berla
Steps to reproduce if available:
1. Create an image containing a symlink .Trash-1000/files -> /home/<user> (or another directory) (e.g. xorriso -as mkisofs -R). 2. The user mounts the image (e.g. "Open With → Disk Image Mounter"). 3. The user ejects it from Nautilus and chooses "Empty" (the default action). 4. The contents of the link target are deleted.
Mitigation if available: Do not choose "Empty" or remove the ability to "Empty Trash" upon ejecting USB devices
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the ability to empty the trash when ejecting USB devices, or ensure users do not choose “Empty” in the eject prompt.
Nautilus Empty Trash upon ejecting USB devices = disabled