CVE-2026-104982 Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal
Remote attackers can exploit a path traversal flaw in the EPUB handler to read arbitrary files or execute code via malicious EPUB files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-104982?
CVE-2026-104982 is a medium-severity path traversal vulnerability in Linux Mint Xreader, published on 3 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 4.6.6 is capable of addressing this issue. Patch name: a5aecea074e8564b7a22f1ce054b31ec862974b7. It is advisable to upgrade the affected component. One of the project maintainers explains, that "EPUB support was removed from Xreader and reimplemented in Xepub".
Weakness: CWE-22
Which versions are affected by CVE-2026-104982?
How do I fix CVE-2026-104982?
No fix has been published for CVE-2026-104982 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-104982 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104982 exists.
Sources
Also known as GHSA-5m53-wrr5-57qq.