Linux Mint Xreader CVE-2026-104983

Requires the victim to open an attacker-supplied, specially crafted PDF in Xreader (versions up to 4.6.9) AND then explicitly save an embedded attachment whose filename contains path-traversal sequences; the unsanitized filename passed to g_file_get_child in the PDF Attachment Saving Handler causes the write to land outside the intended directory. Limiting factors: exploitation is bounded by required user interaction (UI:P - the victim must both open the document and initiate the attachment save), no authentication is needed (PR:N), and the write occurs only at the victim user's privilege level, not elevated. No special non-default configuration is required beyond Xreader being the handler used to open and save PDF attachments.

Signals point to a genuine but modest-priority issue rather than a top-tier emergency. The CVSS 4.0 base score is 5.3 (medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P: network-reachable and unauthenticated, but gated on passive user interaction (the victim must open a crafted PDF and save its attachment). Exploit maturity is E:P (proof-of-concept), consistent with the POC=YES signal (public gist). On an SSVC reading: exploitation = PoC (not active), automatable = NO (user interaction breaks mass automation), and technical impact is partial/low (VC:L/VI:L/VA:L). There is NO CISA KEV listing and NO EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified from this data. The signals are internally consistent - a real, publicly-demonstrated path traversal (CWE-22) with low per-dimension impact and a user-interaction gate - so this is a legitimate fix-in-normal-cycle issue, not a drop-everything priority. One important caveat: patch status is DISPUTED. A maintainer closed the upstream issue as 'completed' on the basis that EPUB support was removed and moved to Xepub, but the vulnerable code path is the PDF Attachment Saving Handler (g_file_get_child in shell/ev-window.c); the description states code analysis indicates this may be a misunderstanding, meaning the PDF attachment flaw may remain unpatched - verify the actual fix with upstream before treating it as resolved.

An attacker crafts a malicious PDF whose embedded attachment carries a filename containing path-traversal sequences (e.g. ../../) and delivers it to a victim via email or a download link. When the victim opens the PDF in Xreader (≤4.6.9) and chooses to save the attachment, the unsanitized filename escapes the intended directory and writes the file to an attacker-chosen location in the user's context. A public proof-of-concept exists, but exploitation still requires the victim to open the document and initiate the save.