CVE-2026-104982 in Xreader
Summary
by MITRE • 10/03/2026
A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 4.6.6 is capable of addressing this issue. Patch name: a5aecea074e8564b7a22f1ce054b31ec862974b7. It is advisable to upgrade the affected component. One of the project maintainers explains, that "EPUB support was removed from Xreader and reimplemented in Xepub".
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/03/2026
A critical security vulnerability has been identified within Linux Mint's Xreader application, specifically affecting versions up through 4.6.5. The flaw resides in the EPUB File Handler component, which is responsible for processing electronic publication files. This issue manifests as a path traversal vulnerability originating from improper input validation and handling of file paths during document content initialization. Specifically, the defect is located within the setup_document_content_list function found in the backend/epub/epub-document.c source file. The root cause involves the use of g_strdup_printf without adequate sanitization or boundary checks on user-supplied data derived from EPUB archives. When an attacker provides a maliciously crafted EPUB file containing directory traversal sequences, such as ../, within metadata files like container.xml or content.opf, the application fails to properly resolve these paths against the intended extraction directory. This allows the software to write extracted resources outside of the designated temporary sandboxing area into arbitrary locations on the host filesystem where the user has write permissions.
The operational impact of this vulnerability is significant due to its potential for remote exploitation and code execution. Although EPUB files are generally considered data containers, they can embed scripts or executable payloads depending on their structure and how the viewer processes them. By leveraging the path traversal flaw, an attacker who tricks a user into opening a maliciously constructed EPUB file can force Xreader to overwrite critical system files or application configuration files with controlled content. This capability effectively enables arbitrary code execution if the overwritten files are subsequently executed by the operating system or other applications. Furthermore, this vulnerability aligns closely with Common Weakness Enumeration category CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The ability to escape the intended directory structure undermines the integrity and confidentiality guarantees expected from sandboxed document viewers.
From an offensive security perspective, this flaw is categorized under MITRE ATT&CK technique T1059: Command and Scripting Interpreter if leveraged for execution, or more broadly within initial access vectors involving malicious files. The fact that a public exploit has been published indicates that the vulnerability is mature and easily reproducible by threat actors with moderate technical expertise. Remote exploitation implies that an attacker does not need local system access to initiate the attack; instead, they can distribute the malformed EPUB file via email attachments, web downloads, or other remote delivery mechanisms. Once a victim opens the file within Xreader, the vulnerability triggers automatically during the document loading phase, potentially leading to full compromise of the user's environment without further interaction.
The project maintainers have acknowledged this security risk and provided a definitive resolution in version 4.6.6. The patch associated with commit hash a5aecea074e8564b7a22f1ce054b31ec862974b7 addresses the input validation deficiencies within the EPUB backend logic. However, it is important to note that one of the project maintainers has clarified that native EPUB support was subsequently removed from Xreader entirely and reimplemented in a separate component called Xepub. This architectural shift suggests that while upgrading to 4.6.6 resolves the immediate issue within the legacy codebase, long-term security posture may depend on migrating to the new implementation which likely incorporates more robust parsing libraries or stricter sandboxing mechanisms designed specifically for complex document formats.
To mitigate this vulnerability immediately, administrators and end-users should upgrade Xreader to version 4.6.6 or later without delay. Given that exploits are publicly available, delaying patch deployment increases exposure to automated scanning tools and targeted attacks. Organizations relying on Linux Mint distributions should verify their package repositories contain the updated binary and enforce regular system updates through standard package management utilities such as apt. Additionally, users should be educated regarding the risks of opening document files from untrusted sources, even if those documents appear benign in format. Implementing application whitelisting or mandatory access control policies like AppArmor can provide an additional layer of defense by restricting Xreader's ability to write outside its expected directories, thereby neutralizing the impact of path traversal flaws should they occur in other components.