Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal
A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. One of the project maintainers closed this issue as "completed", because "EPUB support was removed from Xreader and reimplemented in Xepub". Code analysis indicates that this might be a misunderstanding of the situation.
CVE-2026-104983
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-104983
Xreader
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:o:linux_mint:xreader:*:*:*:*:*:*:*:*"
],
"vendor": "Linux Mint",
"modules": [
"PDF Attachment Saving Handler"
],
"product": "Xreader",
"versions": [
{
"status": "affected",
"version": "4.6.0"
},
{
"status": "affected",
"version": "4.6.1"
},
{
"status": "affected",
"version": "4.6.2"
},
{
"status": "affected",
"version": "4.6.3"
},
{
"status": "affected",
"version": "4.6.4"
},
{
"status": "affected",
"version": "4.6.5"
},
{
"status": "affected",
"version": "4.6.6"
},
{
"status": "affected",
"version": "4.6.7"
},
{
"status": "affected",
"version": "4.6.8"
},
{
"status": "affected",
"version": "4.6.9"
}
]
}
]- Related CVEs
- CVE-2026-104983
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #8796 · Revision 1
- Added to Heist Feed
- Publisher date