TI-2026-67467 Aliases CVE-2026-104982 GHSA-5m53-wrr5-57qq

Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal

MEDIUM 57CWE-22Published 2026-10-03 · Updated 2026-10-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 4.6.6 is capable of addressing this issue. Patch name: a5aecea074e8564b7a22f1ce054b31ec862974b7. It is advisable to upgrade the affected component. One of the project maintainers explains, that "EPUB support was removed from Xreader and reimplemented in Xepub".

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00435 38th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Xreader (Linux Mint): 4.6.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Linux Mint	Xreader	4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.6.5	4.6.6	Patch available	CNA

Xreader VendorLinux Mint Affected 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.6.5 Fixed in 4.6.6 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:linux_mint:xreader::::::::	—	—	—

cpe:2.3:o:linux_mint:xreader:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA Xreader (Linux Mint) Fixed in 4.6.6

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-03 Threatist record created from CVE-2026-104982
2026-10-03 Alias added: GHSA-5m53-wrr5-57qq
2026-10-06 Affected versions changed · Red Hat
2026-10-06 CVSS score added · Red Hat
2026-10-06 CISA SSVC decision points changed
2026-10-06 Priority changed: LOW → MEDIUM

References

Exploit 1

https://gist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2

Patch 2

Other 1

https://github.com/linuxmint/xreader/issues/713

TI-2026-67482 Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal CVSS 4.0MEDIUM 5.3
TI-2019-12744 mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a… CVSS 3.1HIGH 7.8
TI-2023-13770 Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames. CVSS 3.1HIGH 7.5
TI-2023-23957 Path traversal in Linux Mint Xreader CVSS 3.1HIGH 7.8
TI-2018-09367 An issue was discovered in Cinnamon 1.9.2 through 3.8.6. CVSS 3.0HIGH 8.1
TI-2023-23958 Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability CVSS 3.1HIGH 7.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences