CVE-2026-104983: Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal
A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function gfilegetchild of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. One of the project maintainers closed this issue as "completed", because "EPUB support was removed from Xreader and reimplemented in Xepub". Code analysis indicates that this might be a misunderstanding of the situation.
Affected Software
Event History
Frequently Asked Questions
What interaction is required for exploitation?
The attacker can perform the attack remotely, but exploitation requires user interaction. The vulnerable code is in the PDF Attachment Saving Handler, so the relevant interaction is saving a PDF attachment.
Which Xreader versions are known to be affected?
Linux Mint Xreader versions up to and including 4.6.9 are identified as affected. No fixed version is provided in the available data.
What can an attacker achieve through this issue?
Manipulating the attachment argument can cause path traversal when the application constructs the destination path. The supplied severity vector indicates potential low impact to confidentiality, integrity, and availability.
Is the issue resolved by the removal of EPUB support?
The available analysis indicates that treating the issue as resolved because EPUB support was removed and reimplemented in Xepub may be a misunderstanding. The reported vulnerable component is the PDF Attachment Saving Handler in Xreader.