This vulnerability arises from inconsistent comparison logic in the addressbook file backend of evolution-data-server. A malicious URI with directory traversal sequences can be stored without proper validation when creating or modifying contacts. Later, during contact deletion, the URI is processed with less strict checks, enabling deletion of arbitrary files on the host filesystem, including potentially critical Flatpak override files. The flaw requires local privileges with D-Bus access and user interaction to exploit.

The vulnerability allows an attacker with local privileges and D-Bus access to delete arbitrary files on the host system by exploiting inconsistent URI validation in evolution-data-server. This could lead to disruption of system or application functionality if critical files are deleted. There is no direct confidentiality impact, but integrity is affected due to unauthorized file deletion. Availability impact is low but present due to potential loss of important files.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-2604 for current remediation guidance. Until a fix is available, restrict Flatpak applications' D-Bus access and limit user privileges to reduce the risk of exploitation. Monitor updates from Red Hat for official fixes.