CVE-2026-104983 describes a path traversal vulnerability in Linux Mint Xreader up to version 4.6.9. The flaw exists in the g_file_get_child function within shell/ev-window.c, part of the PDF Attachment Saving Handler. By manipulating the attachment argument, an attacker can perform path traversal, potentially accessing unauthorized filesystem locations. The vulnerability can be exploited remotely and exploit details have been publicly disclosed. A project maintainer closed the issue citing removal of EPUB support from Xreader and reimplementation in Xepub, but code analysis indicates this closure may not fully address the vulnerability. No patch or fix details are provided.

The vulnerability allows remote attackers to perform path traversal via crafted attachment arguments, potentially leading to unauthorized file access or overwriting files on the system where Xreader is running. The CVSS 4.0 score of 5.3 indicates a medium severity impact with low complexity and no privileges required, but user interaction is needed. The vulnerability could lead to limited confidentiality, integrity, and availability impacts. No known exploits in the wild are reported.

No official patch or remediation is currently confirmed. The maintainer's closure referencing removal of EPUB support does not explicitly confirm a fix for this vulnerability. Users should monitor the Linux Mint project advisories for updates. Until an official fix is released, cautious handling of untrusted PDF attachments and limiting exposure of Xreader to untrusted networks is advisable.