| शीर्षक | Linux Mint Xreader 4.6.3 Path traversal |
|---|
| विवरण | A path traversal vulnerability in Linux Mint Xreader 4.6.3 allows an attacker to write an embedded PDF attachment outside the directory selected by the user. Xreader passes the attacker-controlled attachment filename directly to g_file_get_child() when saving attachments, allowing directory traversal sequences such as ../ to escape the selected destination directory. This can result in an attacker-controlled file being written with an attacker-controlled filename to another location writable by the user. Exploitation requires the victim to open the crafted PDF and save the malicious attachment.
|
|---|
| स्रोत | ⚠️ https://github.com/linuxmint/xreader/issues/714 |
|---|
| उपयोगकर्ता | rodtvs (UID 94532) |
|---|
| सबमिशन | 08/09/2026 02:47 PM (25 दिन पहले) |
|---|
| संयम | 02/10/2026 08:33 PM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413199 [Linux Mint Xreader तक 4.6.9 PDF Attachment Saving shell/ev-window.c g_file_get_child attachment निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|