Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-104983 (GCVE-0-2026-104983)

Vulnerability from nvd – Published: 2026-10-03 10:30 – Updated: 2026-10-05 16:30 X_Open Source

Title

Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal

Summary

A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. One of the project maintainers closed this issue as "completed", because "EPUB support was removed from Xreader and reimplemented in Xepub". Code analysis indicates that this might be a misunderstanding of the situation.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-05 16:28 UTC

CWE

CWE-22 - Path Traversal

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3753 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/413199	vdb-entrytechnical-description
https://vuldb.com/vuln/413199/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-104983	third-party-advisory
https://vuldb.com/submit/964349	third-party-advisory
https://github.com/linuxmint/xreader/issues/714	issue-tracking
https://gist.github.com/rodtvs/63a34e7b20a9f97a1a…	exploit

Impacted products

1 product

Vendor	Product	Version
Linux Mint	Xreader	Affected: 4.6.0 Affected: 4.6.1 Affected: 4.6.2 Affected: 4.6.3 Affected: 4.6.4 Affected: 4.6.5 Affected: 4.6.6 Affected: 4.6.7 Affected: 4.6.8 Affected: 4.6.9 cpe:2.3:o:linux_mint:xreader::::::::

Credits

rodtvs (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104983",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T16:28:59.753727Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T16:30:40.939Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:linux_mint:xreader:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "PDF Attachment Saving Handler"
          ],
          "product": "Xreader",
          "vendor": "Linux Mint",
          "versions": [
            {
              "status": "affected",
              "version": "4.6.0"
            },
            {
              "status": "affected",
              "version": "4.6.1"
            },
            {
              "status": "affected",
              "version": "4.6.2"
            },
            {
              "status": "affected",
              "version": "4.6.3"
            },
            {
              "status": "affected",
              "version": "4.6.4"
            },
            {
              "status": "affected",
              "version": "4.6.5"
            },
            {
              "status": "affected",
              "version": "4.6.6"
            },
            {
              "status": "affected",
              "version": "4.6.7"
            },
            {
              "status": "affected",
              "version": "4.6.8"
            },
            {
              "status": "affected",
              "version": "4.6.9"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "rodtvs (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. One of the project maintainers closed this issue as \"completed\", because \"EPUB support was removed from Xreader and reimplemented in Xepub\". Code analysis indicates that this might be a misunderstanding of the situation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:30:12.568Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413199 | Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413199"
        },
        {
          "name": "VDB-413199 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413199/cti"
        },
        {
          "name": "CVE-2026-104983 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-104983"
        },
        {
          "name": "Submit #964349 | Linux Mint Xreader 4.6.3 Path traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/964349"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/linuxmint/xreader/issues/714"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-02T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-02T20:38:19.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-104983",
    "datePublished": "2026-10-03T10:30:12.568Z",
    "dateReserved": "2026-10-02T18:33:04.627Z",
    "dateUpdated": "2026-10-05T16:30:40.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104982 (GCVE-0-2026-104982)

Vulnerability from nvd – Published: 2026-10-03 08:00 – Updated: 2026-10-06 16:47 X_Open Source

Title

Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal

Summary

A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 4.6.6 is capable of addressing this issue. Patch name: a5aecea074e8564b7a22f1ce054b31ec862974b7. It is advisable to upgrade the affected component. One of the project maintainers explains, that "EPUB support was removed from Xreader and reimplemented in Xepub".

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 16:47 UTC

CWE

CWE-22 - Path Traversal

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3753 records in the last 180 days details

References

8 references

URL	Tags
https://vuldb.com/vuln/413198	vdb-entrytechnical-description
https://vuldb.com/vuln/413198/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-104982	third-party-advisory
https://vuldb.com/submit/964347	third-party-advisory
https://github.com/linuxmint/xreader/issues/713	issue-tracking
https://gist.github.com/rodtvs/63a34e7b20a9f97a1a…	exploit
https://github.com/linuxmint/xreader/commit/a5aec…	patch
https://github.com/linuxmint/xreader/releases/tag/4.6.6	patch

Impacted products

1 product

Vendor	Product	Version
Linux Mint	Xreader	Affected: 4.6.0 Affected: 4.6.1 Affected: 4.6.2 Affected: 4.6.3 Affected: 4.6.4 Affected: 4.6.5 Unaffected: 4.6.6 cpe:2.3:o:linux_mint:xreader::::::::

Credits

rodtvs (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104982",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T16:47:25.523844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T16:47:34.338Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:linux_mint:xreader:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "EPUB File Handler"
          ],
          "product": "Xreader",
          "vendor": "Linux Mint",
          "versions": [
            {
              "status": "affected",
              "version": "4.6.0"
            },
            {
              "status": "affected",
              "version": "4.6.1"
            },
            {
              "status": "affected",
              "version": "4.6.2"
            },
            {
              "status": "affected",
              "version": "4.6.3"
            },
            {
              "status": "affected",
              "version": "4.6.4"
            },
            {
              "status": "affected",
              "version": "4.6.5"
            },
            {
              "status": "unaffected",
              "version": "4.6.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "rodtvs (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 4.6.6 is capable of addressing this issue. Patch name: a5aecea074e8564b7a22f1ce054b31ec862974b7. It is advisable to upgrade the affected component. One of the project maintainers explains, that \"EPUB support was removed from Xreader and reimplemented in Xepub\"."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T08:00:14.805Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413198 | Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413198"
        },
        {
          "name": "VDB-413198 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413198/cti"
        },
        {
          "name": "CVE-2026-104982 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-104982"
        },
        {
          "name": "Submit #964347 | Linux Mint Xreader 4.6.3 Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/964347"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/linuxmint/xreader/issues/713"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/linuxmint/xreader/commit/a5aecea074e8564b7a22f1ce054b31ec862974b7"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/linuxmint/xreader/releases/tag/4.6.6"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-02T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-02T20:38:15.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-104982",
    "datePublished": "2026-10-03T08:00:14.805Z",
    "dateReserved": "2026-10-02T18:33:00.512Z",
    "dateUpdated": "2026-10-06T16:47:34.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-44452 (GCVE-0-2023-44452)

Vulnerability from nvd – Published: 2024-05-03 02:14 – Updated: 2024-08-08 14:58

Title

Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability

Summary

Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CBT files. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22132.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-16 19:33 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 108 records in the last 180 days details

References

2 references

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory
https://github.com/linuxmint/xreader/commit/cd678…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Linux Mint	Xreader	Affected: 3.8.2
linuxmint	linuxmint	Affected: 3.8.2 cpe:2.3:o:linuxmint:linuxmint::::::::

Date Public

2023-12-20 20:51

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:07:33.122Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ZDI-23-1836",
            "tags": [
              "x_research-advisory",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1836/"
          },
          {
            "name": "vendor-provided URL",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://github.com/linuxmint/xreader/commit/cd678889ecfe4e84a5cbcf3a0489e15a5e2e3736"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linuxmint:linuxmint:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linuxmint",
            "vendor": "linuxmint",
            "versions": [
              {
                "status": "affected",
                "version": "3.8.2"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-16T19:33:13.301025Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-08T14:58:50.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xreader",
          "vendor": "Linux Mint",
          "versions": [
            {
              "status": "affected",
              "version": "3.8.2"
            }
          ]
        }
      ],
      "dateAssigned": "2023-09-28T18:14:48.386Z",
      "datePublic": "2023-12-20T20:51:06.104Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of CBT files. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22132."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-03T02:14:13.246Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-23-1836",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1836/"
        },
        {
          "name": "vendor-provided URL",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/linuxmint/xreader/commit/cd678889ecfe4e84a5cbcf3a0489e15a5e2e3736"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Febin Mon Saji"
      },
      "title": "Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2023-44452",
    "datePublished": "2024-05-03T02:14:13.246Z",
    "dateReserved": "2023-09-28T18:02:49.776Z",
    "dateUpdated": "2024-08-08T14:58:50.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44451 (GCVE-0-2023-44451)

Vulnerability from nvd – Published: 2024-05-03 02:14 – Updated: 2024-08-02 20:07

Title

Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability

Summary

Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EPUB files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21897.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-21 15:29 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 108 records in the last 180 days details

References

2 references

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory
https://github.com/linuxmint/xreader/commit/141f1…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Linux Mint	Xreader	Affected: 3.8.2
linux_mint	xreader	Affected: 3.8.2 cpe:2.3:a:linux_mint:xreader:3.8.2:::::::*

Date Public

2023-12-20 20:50

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:linux_mint:xreader:3.8.2:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xreader",
            "vendor": "linux_mint",
            "versions": [
              {
                "status": "affected",
                "version": "3.8.2"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44451",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T15:29:17.828475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:19:33.709Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:07:33.425Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ZDI-23-1835",
            "tags": [
              "x_research-advisory",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1835/"
          },
          {
            "name": "vendor-provided URL",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://github.com/linuxmint/xreader/commit/141f1313745b9cc73670df51ac145165efcbb14a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xreader",
          "vendor": "Linux Mint",
          "versions": [
            {
              "status": "affected",
              "version": "3.8.2"
            }
          ]
        }
      ],
      "dateAssigned": "2023-09-28T18:14:48.380Z",
      "datePublic": "2023-12-20T20:50:55.281Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EPUB files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21897."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-03T02:14:12.509Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-23-1835",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1835/"
        },
        {
          "name": "vendor-provided URL",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/linuxmint/xreader/commit/141f1313745b9cc73670df51ac145165efcbb14a"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Febin Mon Saji"
      },
      "title": "Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2023-44451",
    "datePublished": "2024-05-03T02:14:12.509Z",
    "dateReserved": "2023-09-28T18:02:49.776Z",
    "dateUpdated": "2024-08-02T20:07:33.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-104983 (GCVE-0-2026-104983)

Vulnerability from cvelistv5 – Published: 2026-10-03 10:30 – Updated: 2026-10-05 16:30 X_Open Source

Title

Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal

Summary

A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. One of the project maintainers closed this issue as "completed", because "EPUB support was removed from Xreader and reimplemented in Xepub". Code analysis indicates that this might be a misunderstanding of the situation.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-05 16:28 UTC

CWE

CWE-22 - Path Traversal

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3753 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/413199	vdb-entrytechnical-description
https://vuldb.com/vuln/413199/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-104983	third-party-advisory
https://vuldb.com/submit/964349	third-party-advisory
https://github.com/linuxmint/xreader/issues/714	issue-tracking
https://gist.github.com/rodtvs/63a34e7b20a9f97a1a…	exploit

Impacted products

1 product

Vendor	Product	Version
Linux Mint	Xreader	Affected: 4.6.0 Affected: 4.6.1 Affected: 4.6.2 Affected: 4.6.3 Affected: 4.6.4 Affected: 4.6.5 Affected: 4.6.6 Affected: 4.6.7 Affected: 4.6.8 Affected: 4.6.9 cpe:2.3:o:linux_mint:xreader::::::::

Credits

rodtvs (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104983",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T16:28:59.753727Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T16:30:40.939Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:linux_mint:xreader:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "PDF Attachment Saving Handler"
          ],
          "product": "Xreader",
          "vendor": "Linux Mint",
          "versions": [
            {
              "status": "affected",
              "version": "4.6.0"
            },
            {
              "status": "affected",
              "version": "4.6.1"
            },
            {
              "status": "affected",
              "version": "4.6.2"
            },
            {
              "status": "affected",
              "version": "4.6.3"
            },
            {
              "status": "affected",
              "version": "4.6.4"
            },
            {
              "status": "affected",
              "version": "4.6.5"
            },
            {
              "status": "affected",
              "version": "4.6.6"
            },
            {
              "status": "affected",
              "version": "4.6.7"
            },
            {
              "status": "affected",
              "version": "4.6.8"
            },
            {
              "status": "affected",
              "version": "4.6.9"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "rodtvs (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. One of the project maintainers closed this issue as \"completed\", because \"EPUB support was removed from Xreader and reimplemented in Xepub\". Code analysis indicates that this might be a misunderstanding of the situation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:30:12.568Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413199 | Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413199"
        },
        {
          "name": "VDB-413199 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413199/cti"
        },
        {
          "name": "CVE-2026-104983 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-104983"
        },
        {
          "name": "Submit #964349 | Linux Mint Xreader 4.6.3 Path traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/964349"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/linuxmint/xreader/issues/714"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-02T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-02T20:38:19.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-104983",
    "datePublished": "2026-10-03T10:30:12.568Z",
    "dateReserved": "2026-10-02T18:33:04.627Z",
    "dateUpdated": "2026-10-05T16:30:40.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104982 (GCVE-0-2026-104982)

Vulnerability from cvelistv5 – Published: 2026-10-03 08:00 – Updated: 2026-10-06 16:47 X_Open Source

Title

Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal

Summary

A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 4.6.6 is capable of addressing this issue. Patch name: a5aecea074e8564b7a22f1ce054b31ec862974b7. It is advisable to upgrade the affected component. One of the project maintainers explains, that "EPUB support was removed from Xreader and reimplemented in Xepub".

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 16:47 UTC

CWE

CWE-22 - Path Traversal

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3753 records in the last 180 days details

References

8 references

URL	Tags
https://vuldb.com/vuln/413198	vdb-entrytechnical-description
https://vuldb.com/vuln/413198/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-104982	third-party-advisory
https://vuldb.com/submit/964347	third-party-advisory
https://github.com/linuxmint/xreader/issues/713	issue-tracking
https://gist.github.com/rodtvs/63a34e7b20a9f97a1a…	exploit
https://github.com/linuxmint/xreader/commit/a5aec…	patch
https://github.com/linuxmint/xreader/releases/tag/4.6.6	patch

Impacted products

1 product

Vendor	Product	Version
Linux Mint	Xreader	Affected: 4.6.0 Affected: 4.6.1 Affected: 4.6.2 Affected: 4.6.3 Affected: 4.6.4 Affected: 4.6.5 Unaffected: 4.6.6 cpe:2.3:o:linux_mint:xreader::::::::

Credits

rodtvs (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104982",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T16:47:25.523844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T16:47:34.338Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:linux_mint:xreader:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "EPUB File Handler"
          ],
          "product": "Xreader",
          "vendor": "Linux Mint",
          "versions": [
            {
              "status": "affected",
              "version": "4.6.0"
            },
            {
              "status": "affected",
              "version": "4.6.1"
            },
            {
              "status": "affected",
              "version": "4.6.2"
            },
            {
              "status": "affected",
              "version": "4.6.3"
            },
            {
              "status": "affected",
              "version": "4.6.4"
            },
            {
              "status": "affected",
              "version": "4.6.5"
            },
            {
              "status": "unaffected",
              "version": "4.6.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "rodtvs (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 4.6.6 is capable of addressing this issue. Patch name: a5aecea074e8564b7a22f1ce054b31ec862974b7. It is advisable to upgrade the affected component. One of the project maintainers explains, that \"EPUB support was removed from Xreader and reimplemented in Xepub\"."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T08:00:14.805Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413198 | Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413198"
        },
        {
          "name": "VDB-413198 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413198/cti"
        },
        {
          "name": "CVE-2026-104982 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-104982"
        },
        {
          "name": "Submit #964347 | Linux Mint Xreader 4.6.3 Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/964347"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/linuxmint/xreader/issues/713"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/linuxmint/xreader/commit/a5aecea074e8564b7a22f1ce054b31ec862974b7"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/linuxmint/xreader/releases/tag/4.6.6"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-02T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-02T20:38:15.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-104982",
    "datePublished": "2026-10-03T08:00:14.805Z",
    "dateReserved": "2026-10-02T18:33:00.512Z",
    "dateUpdated": "2026-10-06T16:47:34.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-44452 (GCVE-0-2023-44452)

Vulnerability from cvelistv5 – Published: 2024-05-03 02:14 – Updated: 2024-08-08 14:58

Title

Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability

Summary

Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CBT files. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22132.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-16 19:33 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 108 records in the last 180 days details

References

2 references

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory
https://github.com/linuxmint/xreader/commit/cd678…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Linux Mint	Xreader	Affected: 3.8.2
linuxmint	linuxmint	Affected: 3.8.2 cpe:2.3:o:linuxmint:linuxmint::::::::

Date Public

2023-12-20 20:51

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:07:33.122Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ZDI-23-1836",
            "tags": [
              "x_research-advisory",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1836/"
          },
          {
            "name": "vendor-provided URL",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://github.com/linuxmint/xreader/commit/cd678889ecfe4e84a5cbcf3a0489e15a5e2e3736"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linuxmint:linuxmint:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linuxmint",
            "vendor": "linuxmint",
            "versions": [
              {
                "status": "affected",
                "version": "3.8.2"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-16T19:33:13.301025Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-08T14:58:50.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xreader",
          "vendor": "Linux Mint",
          "versions": [
            {
              "status": "affected",
              "version": "3.8.2"
            }
          ]
        }
      ],
      "dateAssigned": "2023-09-28T18:14:48.386Z",
      "datePublic": "2023-12-20T20:51:06.104Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of CBT files. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22132."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-03T02:14:13.246Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-23-1836",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1836/"
        },
        {
          "name": "vendor-provided URL",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/linuxmint/xreader/commit/cd678889ecfe4e84a5cbcf3a0489e15a5e2e3736"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Febin Mon Saji"
      },
      "title": "Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2023-44452",
    "datePublished": "2024-05-03T02:14:13.246Z",
    "dateReserved": "2023-09-28T18:02:49.776Z",
    "dateUpdated": "2024-08-08T14:58:50.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44451 (GCVE-0-2023-44451)

Vulnerability from cvelistv5 – Published: 2024-05-03 02:14 – Updated: 2024-08-02 20:07

Title

Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability

Summary

Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EPUB files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21897.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-21 15:29 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 108 records in the last 180 days details

References

2 references

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory
https://github.com/linuxmint/xreader/commit/141f1…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Linux Mint	Xreader	Affected: 3.8.2
linux_mint	xreader	Affected: 3.8.2 cpe:2.3:a:linux_mint:xreader:3.8.2:::::::*

Date Public

2023-12-20 20:50

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:linux_mint:xreader:3.8.2:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xreader",
            "vendor": "linux_mint",
            "versions": [
              {
                "status": "affected",
                "version": "3.8.2"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44451",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T15:29:17.828475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:19:33.709Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:07:33.425Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ZDI-23-1835",
            "tags": [
              "x_research-advisory",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1835/"
          },
          {
            "name": "vendor-provided URL",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://github.com/linuxmint/xreader/commit/141f1313745b9cc73670df51ac145165efcbb14a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xreader",
          "vendor": "Linux Mint",
          "versions": [
            {
              "status": "affected",
              "version": "3.8.2"
            }
          ]
        }
      ],
      "dateAssigned": "2023-09-28T18:14:48.380Z",
      "datePublic": "2023-12-20T20:50:55.281Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EPUB files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21897."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-03T02:14:12.509Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-23-1835",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1835/"
        },
        {
          "name": "vendor-provided URL",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/linuxmint/xreader/commit/141f1313745b9cc73670df51ac145165efcbb14a"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Febin Mon Saji"
      },
      "title": "Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2023-44451",
    "datePublished": "2024-05-03T02:14:12.509Z",
    "dateReserved": "2023-09-28T18:02:49.776Z",
    "dateUpdated": "2024-08-02T20:07:33.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

8 vulnerabilities found for Xreader by Linux Mint

CVE-2026-104983 (GCVE-0-2026-104983)

CVE-2026-104982 (GCVE-0-2026-104982)

CVE-2023-44452 (GCVE-0-2023-44452)

CVE-2023-44451 (GCVE-0-2023-44451)

CVE-2026-104983 (GCVE-0-2026-104983)

CVE-2026-104982 (GCVE-0-2026-104982)

CVE-2023-44452 (GCVE-0-2023-44452)

CVE-2023-44451 (GCVE-0-2023-44451)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

8 vulnerabilities found for Xreader by Linux Mint

CVE-2026-104983 (GCVE-0-2026-104983)

CVE-2026-104982 (GCVE-0-2026-104982)

CVE-2023-44452 (GCVE-0-2023-44452)

CVE-2023-44451 (GCVE-0-2023-44451)

CVE-2026-104983 (GCVE-0-2026-104983)

CVE-2026-104982 (GCVE-0-2026-104982)

CVE-2023-44452 (GCVE-0-2023-44452)

CVE-2023-44451 (GCVE-0-2023-44451)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.