CVE-2026-104983 in Xreader
Summary
by MITRE • 10/03/2026
A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. One of the project maintainers closed this issue as "completed", because "EPUB support was removed from Xreader and reimplemented in Xepub". Code analysis indicates that this might be a misunderstanding of the situation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The Linux Mint distribution includes Xreader, an open-source document viewer based on Evince, which provides functionality for viewing various file formats including PDFs. A critical security flaw has been identified within the PDF attachment saving handler component, specifically located in the g_file_get_child function found in the shell/ev-window.c source file of versions up to 4.6.9. This vulnerability stems from an improper validation mechanism when handling user-supplied input related to document attachments. The core technical issue is a path traversal flaw that allows an attacker to manipulate the attachment argument to access files and directories outside the intended scope, potentially leading to unauthorized read or write operations depending on the context of execution.
The operational impact of this vulnerability is significant because it can be exploited remotely without requiring prior authentication in certain scenarios where documents are opened from untrusted sources such as email attachments or web downloads. By crafting a malicious PDF file containing specially constructed attachment metadata, an attacker can induce Xreader to traverse directory paths using sequences like dot-dot-slash characters. This could result in the disclosure of sensitive system files if the application runs with elevated privileges or allows overwriting critical configuration files if write permissions are granted through similar mechanisms. The existence of a public exploit further exacerbates the risk profile, as it lowers the barrier for entry for less sophisticated threat actors seeking to compromise systems running affected versions of Xreader.
Industry standards classify this type of vulnerability under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that can cause the path to resolve outside of the intended directory. In terms of offensive security tactics, this aligns with MITRE ATT&CK technique T1083: File and Directory Discovery, as an attacker would use the traversal capability to enumerate system structure, potentially leading to further exploitation vectors such as data exfiltration or privilege escalation if combined with other vulnerabilities in the host environment. The ability to read arbitrary files can serve as a reconnaissance step for lateral movement within a networked environment where compromised workstations are targeted.
Despite public disclosure and available exploit code, one of the project maintainers closed this issue as completed based on the rationale that EPUB support was removed from Xreader and reimplemented in a separate application called Xepub. However, technical analysis indicates this decision may stem from a misunderstanding of the vulnerability's scope. The flaw resides within the PDF attachment handling logic rather than any EPUB-specific parsing code. Therefore, removing EPUB functionality does not mitigate the path traversal issue present in the PDF viewer component itself. This highlights a critical gap between reported vulnerabilities and their resolution status, leaving users of Xreader versions up to 4.6.9 exposed to active exploitation until an official patch is released that specifically addresses the input validation logic in shell/ev-window.c.
To mitigate this risk immediately, organizations should restrict the execution of untrusted PDF documents or disable attachment saving features if not required for business operations. Users are advised to upgrade to a version where this specific path traversal flaw has been patched with proper canonicalization and boundary checks on file paths before processing. Additionally, implementing application whitelisting or sandboxing solutions can limit the impact of any successful exploitation by restricting the filesystem access rights granted to the Xreader process. Regular monitoring for updates from Linux Mint and upstream Evince developers is essential to ensure timely remediation as this vulnerability remains unpatched in the currently affected release stream due to the aforementioned misclassification during issue closure.