Xreader
Monthly
Path traversal in Linux Mint Xreader up to 4.6.9 allows an attacker-supplied PDF to write an embedded attachment file outside the directory the victim selected, because the attachment filename is passed unsanitized to g_file_get_child in the PDF Attachment Saving Handler (shell/ev-window.c). Exploitation requires the victim to open the crafted PDF and explicitly initiate a save of the embedded attachment; authentication requirements are not confirmed from available data, though the assessed vector is PR:N (no privileges required), and the write occurs only at the victim's own privilege level, so confidentiality and integrity impact is low (VC:L/VI:L/VA:L). Publicly available exploit code exists (a public gist referenced by the vendor record), but there is no CISA KEV listing and no confirmation of active exploitation; the issue remains a modest-priority signal rather than a top-tier emergency.
Path traversal in Linux Mint Xreader 4.6.5 and earlier can disclose readable local files when a victim opens a crafted EPUB document in the built-in EPUB backend, and publicly available exploit code exists. Exploitation is remote but requires user interaction and no authentication; version 4.6.6 removes the EPUB backend entirely, and the practical impact is limited to low-confidentiality disclosure. This is a low-priority issue despite being remotely reachable.
Path traversal in Linux Mint Xreader up to 4.6.9 allows an attacker-supplied PDF to write an embedded attachment file outside the directory the victim selected, because the attachment filename is passed unsanitized to g_file_get_child in the PDF Attachment Saving Handler (shell/ev-window.c). Exploitation requires the victim to open the crafted PDF and explicitly initiate a save of the embedded attachment; authentication requirements are not confirmed from available data, though the assessed vector is PR:N (no privileges required), and the write occurs only at the victim's own privilege level, so confidentiality and integrity impact is low (VC:L/VI:L/VA:L). Publicly available exploit code exists (a public gist referenced by the vendor record), but there is no CISA KEV listing and no confirmation of active exploitation; the issue remains a modest-priority signal rather than a top-tier emergency.
Path traversal in Linux Mint Xreader 4.6.5 and earlier can disclose readable local files when a victim opens a crafted EPUB document in the built-in EPUB backend, and publicly available exploit code exists. Exploitation is remote but requires user interaction and no authentication; version 4.6.6 removes the EPUB backend entirely, and the practical impact is limited to low-confidentiality disclosure. This is a low-priority issue despite being remotely reachable.