Medium severity · published Oct 3, 2026
CVE-2026-104982
Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 4.6.6 is capable of addressing this issue. Patch name: a5aecea074e8564b7a22f1ce054b31ec862974b7. It is advisable to upgrade the affected component. One of the project maintainers explains, that "EPUB support was removed from Xreader and reimplemented in Xepub".
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XR
Xreader · Linux Mint
4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.6.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104982
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104982
vdb-entry
https://vuldb.com/vuln/413198
signature
https://vuldb.com/vuln/413198/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-104982
third-party-advisory
https://vuldb.com/submit/964347
issue-tracking
https://github.com/linuxmint/xreader/issues/713
exploit
https://gist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2
More from Xreader
7.8
CVE-2023-44452
Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability
7.8
CVE-2023-44451
Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability
6.3
CVE-2026-104983
Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal