TI-2026-67482 Aliases CVE-2026-104983 GHSA-63c6-qprh-g95r

Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal

MEDIUM 57CWE-22Published 2026-10-03 · Updated 2026-10-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. One of the project maintainers closed this issue as "completed", because "EPUB support was removed from Xreader and reimplemented in Xepub". Code analysis indicates that this might be a misunderstanding of the situation.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00431 37th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Linux Mint	Xreader	4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.6.5; 4.6.6; 4.6.7; 4.6.8; 4.6.9	—	No fix listed	CNA

Xreader VendorLinux Mint Affected 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.6.5; 4.6.6; 4.6.7; 4.6.8; 4.6.9 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:linux_mint:xreader::::::::	—	—	—

cpe:2.3:o:linux_mint:xreader:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-03 Threatist record created from CVE-2026-104983
2026-10-03 Alias added: GHSA-63c6-qprh-g95r
2026-10-05 CISA SSVC decision points changed
2026-10-05 Priority changed: LOW → MEDIUM
2026-10-06 Affected versions changed · Red Hat
2026-10-06 CVSS score added · Red Hat

References

Exploit 1

https://gist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2

Other 1

https://github.com/linuxmint/xreader/issues/714

TI-2026-67467 Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal CVSS 4.0MEDIUM 5.3
TI-2019-12744 mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a… CVSS 3.1HIGH 7.8
TI-2023-13770 Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames. CVSS 3.1HIGH 7.5
TI-2023-23957 Path traversal in Linux Mint Xreader CVSS 3.1HIGH 7.8
TI-2018-09367 An issue was discovered in Cinnamon 1.9.2 through 3.8.6. CVSS 3.0HIGH 8.1
TI-2023-23958 Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability CVSS 3.1HIGH 7.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences