Bug 2546312 - CVE-2026-104982 xreader: xreader: Information disclosure via path traversal in EPUB file handling [fedora-all]
Summary: CVE-2026-104982 xreader: xreader: Information disclosure via path traversal i...
Keywords:
Status: CLOSED COMPLETED
Alias: None
Product: Fedora
Classification: Fedora
Component: xreader
Version: rawhide
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
Assignee: leigh scott
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["ce04b20c-1f66-46ce-9e0a-8...
Depends On:
Blocks: CVE-2026-104982
TreeView+ depends on / blocked
 
Reported: 2026-10-06 08:01 UTC by Vladimir Vasilev
Modified: 2026-10-06 08:25 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-10-06 08:25:32 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Vladimir Vasilev 2026-10-06 08:01:37 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 4.6.6 is capable of addressing this issue. Patch name: a5aecea074e8564b7a22f1ce054b31ec862974b7. It is advisable to upgrade the affected component. One of the project maintainers explains, that "EPUB support was removed from Xreader and reimplemented in Xepub".
Comment 1 leigh scott 2026-10-06 08:25:32 UTC 
No fedora release has epub support.
Note You need to log in before you can comment on or make changes to this bug.