CVE-2026-111802

Executive Summary

CVE-2026-111802 is a symbolic-link following flaw (CWE-59) in Nautilus, the GNOME desktop file manager. When a removable drive or disk image is unmounted or ejected, Nautilus offers to empty the trash and does not verify whether the underlying trash directory paths are symbolic links. An attacker who convinces a user to mount a crafted storage volume and confirm the empty-trash prompt can cause arbitrary deletion of files accessible to that user. The vulnerability is local, requires user interaction, and has no impact on confidentiality, but carries high integrity and availability impact (CVSS 6.6).

Technical Analysis

The defect sits in the unmount/eject handling path of Nautilus. When a mount point is torn down, the application enumerates trash locations associated with the volume and presents a confirmation dialog asking the user to empty the trash. The code path does not check whether the trash directory entries it is about to operate on are symbolic links before acting on them.

Because the check is absent, a crafted storage volume can present a trash path that is a symbolic link pointing to an arbitrary location — for example, a user's home directory or another writable directory owned by that user. When the user confirms the prompt, Nautilus follows the link and performs deletion against the link target rather than a contained trash directory. The result is recursive, attacker-influenced file deletion within the privileges of the logged-in user.

The relevant security properties are:

• Attack vector: Local (AV:L). The attacker must get a crafted volume mounted — physically via removable media or logically via a disk image.
• Complexity: Low (AC:L). Once the malicious volume is mounted, the flaw triggers on the routine unmount/eject flow.
• Privileges required: Low (PR:L). The mount and confirmation occur in the context of the logged-in desktop user.
• User interaction: Required (UI:R). The victim must confirm the empty-trash prompt.
• Impact: No confidentiality impact (C:N), high integrity impact (I:H) and high availability impact (A:H), reflecting permanent, irreversible deletion of user data.

The root cause is the classic time-of-check/time-of-use and link-following class of bug: any file operation performed on paths that an attacker can influence (such as those sourced from a mounted volume) must operate on a validated, resolved path, or must refuse to traverse symbolic links. CWE-59 classifies precisely this "link following" behavior. The NVD description does not disclose specific function names, file paths, or parameter names, so implementation-level detail beyond the described mechanism is not available.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. The attack chain below is inferred strictly from the vulnerability class (symbolic-link following during a privileged file operation) and the NVD description; no specific code patterns or function names are fabricated.

1. Reconnaissance / target identification. The attacker positions a removable drive or supplies a disk image designed to be mounted on the target GNOME/Nautilus system. The attacker needs only local or physical access sufficient to have the volume mounted — e.g., handing over a USB stick or a crafted disk image file — and does not require prior privileges on the host.

2. Triggering the flaw class. The crafted volume contains a trash directory structure in which the trash path is a symbolic link rather than a real directory. The victim mounts the volume in the normal way (auto-mount or explicit mount of a disk image).

3. Execution of the deceptive action. When the volume is unmounted or ejected, Nautilus presents the empty-trash prompt. Because it does not verify that the trash paths are symbolic links, confirming the prompt causes Nautilus to resolve the link and delete the contents of whatever the link points to — under the victim user's permission set.

4. Post-exploitation impact. The victim's accessible files at the link target are lost. This can include profiles, configuration, documents, or any directory the user can write to within their own ownership. If the target points to a privileged directory the user can write to, those artifacts are also deleted. There is no data exfiltration (C:N) — the outcome is destructive: data integrity and availability are impacted.

The chain requires the victim's confirmation, which is the primary constraint on exploitation. Social engineering — presenting the volume as a legitimate removable device or disk image — is the most plausible delivery vector.

Impact Assessment

• Confidentiality: None (C:N). The flaw does not read or expose file contents.
• Integrity: High (I:H). File deletion is destructive and irreversible.
• Availability: High (A:H). Loss of user data directly degrades availability of the victim's working environment.
• Scope: Unchanged (S:U). The impact is confined to the security authority of the vulnerable Nautilus process/user context.

Business impact: For organizations running GNOME desktops — engineering workstations, Linux developer fleets, shared lab machines — the exposure is data loss rather than data theft. Users who mount untrusted removable media or disk images handed to them by outsiders are at risk. The social-engineering precondition means the attack is best chained with a pretext (e.g., "review this disk image"). Blast radius is per-user: whatever the logged-in user can write is at risk, which can include local configuration, unsaved work, and shared project directories if the user owns them.

Detection outlook: There is no network telemetry for a purely local desktop action, so detection must rely on endpoint/integrity monitoring — auditing of unmount/eject events and anomalous recursive deletions under user-writable paths.

Detection Guidance

Sigma Rule

title: Nautilus Symbolic-Link Trash-Deletion on Unmount/Eject
id: 3f6a9c1e-7b2d-4e88-9a1f-1c2d3e4f5a6b
status: experimental
description: Detects unmount/eject of removable media or disk images followed closely by recursive deletion activity attributable to the desktop file manager, consistent with CVE-2026-111802 link-following.
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_unmount:
    type: 'SYSCALL'
    syscall: 'umount2'
  selection_delete:
    type: 'PATH'
    nametype: 'DELETE'
  timeframe: 1m
  condition: selection_unmount | near selection_delete
fields:
  - auid
  - uid
  - exe
  - name
level: medium
falsepositives:
  - Legitimate removable media ejection followed by normal cleanup
  - Backup or sync tools performing recursive deletion of user directories
tags:
  - attack.t1204
  - attack.impact

Note: Sigma tuning will be required. The rule correlates the umount2 syscall with subsequent PATH DELETE audit events; deploy with an exe: filter for nautilus and for legitimate sync tools to reduce noise.

YARA Rule

rule CVE_2026_111802_Nautilus_Trash_Symlink_Volume
{
    meta:
        description = "Detects crafted storage volumes or disk images carrying a symbolic-link trash structure intended to exploit CVE-2026-111802 in Nautilus"
        author = "Valters IT Threat Intelligence"
        reference = "CVE-2026-111802"
        date = "2026-01-01"
        cwe = "CWE-59"
    strings:
        $trash_dir_1 = ".Trash" ascii wide
        $trash_dir_2 = ".Trash-1000" ascii wide
        $trash_file_1 = "files/" ascii wide
        $trash_file_2 = "info/" ascii wide
        $link_marker = "l" ascii wide
    condition:
        (
            any of ($trash_dir_*)
        ) and filesize < 10MB
}

Note: YARA is a poor fit for this vulnerability — the artifact is a filesystem layout, not a byte pattern. This rule should be used with filesystem-aware tooling (e.g., scanning mounted volumes or images) rather than as a standalone file-matching rule. It is included for completeness; it will generate false positives on benign volumes containing trash directories and should be treated as a triage aid only.

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-111802 Nautilus Exploit Attempt - NOT APPLICABLE (local-only vulnerability)"; reference:cve,2026-111802; classtype:attempted-user; sid:1000001; rev:1;)

Note: CVE-2026-111802 is a purely local desktop flaw with no network-facing component. No network detection signatures apply; the above is a placeholder demonstrating that no traffic signature is meaningful. Rely on host-based detection (Sigma, auditd, integrity monitoring) instead.

Elastic Detection

process where host.os.type == "linux" and
  event.action == "end" and
  process.name in ("nautilus", "gvfsd-trash", "gvfsd") and
  process.args : "*trash*"
sequence by host.id, user.id with maxspan=2m
  [ process where host.os.type == "linux" and process.name == "umount" ]
  [ process where host.os.type == "linux" and
      process.name in ("nautilus", "gvfsd-trash") and
      process.exit_code == 0 ]

Note: This EQL sequence looks for a mount-teardown process followed by a Nautilus/gvfs trash-related process within a two-minute window. It depends on process telemetry from Elastic Defend or auditbeat. Tune the second condition to include the actual gvfsd trash helper behaviors observed in your fleet; the eBPF process event model may not surface the deletion target. Pair with file-integrity monitoring for deletion events under /home/*.

Splunk SPL Query

index=linux_audit sourcetype=auditd OR source=auditd
| eval act=coalesce(syscall, type)
| where act="umount2" OR (act="PATH" AND nametype="DELETE" AND exe="*/nautilus")
| transaction auid maxspan=2m
| where mvcount(syscall)>1 OR mvcount(nametype)>1
| stats count earliest(_time) as first_seen latest(_time) as last_seen by host, auid, exe
| where count > 0

Note: Tune the transaction field to the auditd auid (login UID) and ensure nametype=DELETE events are being collected from auditd. If file-integrity monitoring is available, join deletion events against a baseline of expected user directories. This query detects the synchronous "unmount then mass delete" signature of a successful exploitation of the described flaw.

Wazuh OSSEC Rule

<group name="cve_2026_111802,nautilus,">
  <rule id="100801" level="10" frequency="3" timeframe="120">
    <if_matched_sid>80784</if_matched_sid>
    <same_field>audit.uid</same_field>
    <description>CVE-2026-111802: Repeated unmount/eject followed by file deletions by uid (potential Nautilus trash-link exploitation)</description>
    <mitre>
      <id>T1204</id>
    </mitre>
    <group>impact,data_destruction,</group>
  </rule>
  <rule id="100802" level="8">
    <decoded_as>audit</decoded_as>
    <field name="syscall">umount2</field>
    <description>Removable media or disk image unmounted - potential precursor to CVE-2026-111802 trash-link deletion</description>
    <group>nautilus,</group>
  </rule>
</group>

Note: Rule 80784 is a standard Wazuh/auditd deletion primitive; adjust the if_matched_sid reference to whichever auditd deletion rule is enabled in your deployment. The syscall field mapping assumes auditd is decoded via Wazuh's auditd decoder and the umount2 syscall field is enabled in the audit configuration.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, and no affected version range or fixed version has been published.

1. Immediate mitigations (no vendor patch available):

   • Educate users not to mount untrusted removable media or disk images and never to confirm the "empty trash" prompt for volumes from unknown sources.
   • Where feasible, restrict unattended auto-mount of removable devices (e.g., via udisks/gvfs configuration) so mounts require explicit user action.
   • Enforce backups and versioned snapshots of user directories so that accidental or malicious recursive deletion can be recovered.
   • Use host file-system integrity monitoring (e.g., auditd PATH/DELETE watch, AIDE, or fanotify-based tooling) on user-writable directories to detect anomalously large deletion events.
   • Apply least-privilege ownership so that each user owns only their own home directory and cannot write to shared system paths.

2. Patch / upgrade steps:

   • Monitor the Nautilus project and the downstream distribution advisories for a fixed release. No fixed version is currently identified. Subscribe to distribution security advisories and upgrade as soon as a patched nautilus package ships. Validate that the fix enforces a symbolic-link check on trash directory paths before deletion.

3. Long-term hardening:

   • Treat any file operation performed on attacker-influenceable paths (especially from mounted volumes) as requiring path resolution and link-traversal guards. This is the same root cause class as CVE-59 link-following, and should be codified as a secure-development review gate.
   • Adopt integrity/link-integrity checks in desktop file-manager code paths that act on removable media.
   • Deploy endpoint detection for "unmount → mass deletion" patterns and maintain user data backups with offline retention.

References

• NVD entry for CVE-2026-111802: https://nvd.nist.gov/vuln/detail/CVE-2026-111802
• MITRE CWE-59 "Improper Link Resolution Before File Access (Link Following)": https://cwe.mitre.org/data/definitions/59.html
• MITRE ATT&CK T1204 "User Execution": https://attack.mitre.org/techniques/T1204/
• GNOME Nautilus project page and issue tracker: https://gitlab.gnome.org/GNOME/nautilus (no public advisory for this CVE identified at time of writing)
• CISA KEV catalog: NOT LISTED — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-111802 is not present in the KEV catalog)

Exploit-in-the-wild evidence: No public proof-of-concept, exploit code, Nuclei template, or observed active exploitation campaign has been identified for CVE-2026-111802. EPSS score is not yet assigned by FIRST.org. All exploitation scenarios above are inferred from the vulnerability class and are labeled as such.