A flaw in the file manager Nautilus causes it to offer to empty the trash when a removable drive or disk image is detached, without checking if the trash directory is a symbolic link. If the trash location points to a symlink that references the filesystem of the remounted volume, a user who confirms the prompt will trigger deletion of files on that volume. The result is the removal of arbitrary files that are writable by the user, compromising file system integrity for the affected account.

All Red Hat Enterprise Linux releases from 6 to 10, which include the Nautilus package shipped with those distributions, are affected. Any system running Nautilus on these OS versions and using removable media or images is vulnerable.

The CVSS base score of 6.6 places the vulnerability in the medium severity range. EPSS is currently unavailable, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires a social‑engineering vector: a malicious removable device must be presented to the user, and the user must confirm the empty‑trash prompt when the device is ejected. Because the attack relies on user interaction and specific filesystem setup, the practical risk is moderate, but any user who engages with the prompt when a malicious volume is mounted can inadvertently delete legitimate data.