rootpwn

medium · CVSS v3 4.3 · CVSS v4 5.3 · EPSS 0.00435

CVE-2026-104982

A path‑traversal flaw in Linux Mint Xreader’s EPUB handler allows remote attackers to read arbitrary files. The issue exists in versions up

Overview

A path‑traversal flaw in Linux Mint Xreader’s EPUB handler allows remote attackers to read arbitrary files. The issue exists in versions up to 4.6.5 and has been publicly exploited. Upgrading to 4.6.6 or later mitigates the vulnerability.

Description

A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 4.6.6 is capable of addressing this issue. Patch name: a5aecea074e8564b7a22f1ce054b31ec862974b7. It is advisable to upgrade the affected component. One of the project maintainers explains, that "EPUB support was removed from Xreader and reimplemented in Xepub".

Impact

The vulnerability can be used to read sensitive files on the host, compromising confidentiality. If an attacker can supply a crafted EPUB file, they may gain access to system configuration or user data. The flaw does not directly alter data, but it can expose information that could aid further attacks.

Remediation

Apply the official patch by upgrading Xreader to version 4.6.6 or later. If an upgrade is not immediately possible, disable EPUB support in Xreader or remove the application entirely. Monitor system logs for anomalous file access patterns related to EPUB processing.

Risk context

With a CVSS v3 score of 4.3 and an EPSS of 0.00435, the risk is moderate but not urgent. Defenders should prioritize the update in a routine patch cycle.

Affected products

  • Linux Mint Xreader 4.6.5
  • Linux Mint Xreader <4.6.5

Scores

Severity
medium
CVSS v2
5
CVSS v3
4.3
CVSS v4
5.3
EPSS
0.00435

path-traversal epub xreader linux-mint medium remote file-access

← All CVEs

Related CVEs

medium

CVE-2026-100157

WP Ultimate Review plugin up to 2.4.3 allows unauthenticated users to execute arbitrary shortcodes via the public review form, enabling remote code execution on the site. The vulnerability stems from improper nonce validation and auto-publishing of submitted shortcodes. This can compromise site integrity and availability.

View analysis

medium

CVE-2026-103762

SiYuan before v3.8.5 has a missing authorization flaw in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read‑only or anonymous publish visitors to discover unpublished notebook box IDs and their creation times. Attackers can POST any open notebook ID to receive the global save‑box ID and save‑path template, revealing hidden notebooks. The vulnerability does not modify data but exposes sensitive metadata.

View analysis

medium

CVE-2026-104910

MISP suffers an authorization bypass in its related events listing, allowing users to retrieve metadata of events they should not see. This can expose threat‑intelligence details across sharing groups.

View analysis

medium

CVE-2026-97344

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to chain two steps: invoking the nonce-only dismiss_ajax_call endpoint (nonce accessible to Subscribers via any wp-admin page) to set the xs_social_profile_image meta flag on their own account, which activates the unescaped img output branch in xs_social_get_avatar, and then setting their display name to a script payload that core's ENT_NOQUOTES handling preserves unescaped.

View analysis