Is CVE-2026-104982 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104982 being exploited in the wild.

How severe is CVE-2026-104982?

Medium severity, with a CVSS score of 4.3, published 3 October 2026.

Which products and versions are affected?

Linux Mint Xreader up to 4.6.5.

Is there a fix for CVE-2026-104982?

Yes: fixed in 4.6.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104982 attacked?

It is attacked over the network.

Am I affected by CVE-2026-104982?

Check whether you run Linux Mint Xreader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104982: Linux Mint Xreader path traversal in EPUB file handler

CVE-2026-104982 · Severity: medium · CVSS 4.3 · Published 2026-10-03

Linux Mint Xreader is a document viewer that handles EPUB e-book files. A path traversal vulnerability in the EPUB handler allows an attacker to craft a malicious EPUB file that, when opened, can read arbitrary files from the system such as passwords or configuration files. The vulnerability was fixed by removing EPUB support entirely from Xreader and moving it to a separate application.

Technologies: Linux Mint Xreader. Vendors: Linux Mint.

Quick answers

Is CVE-2026-104982 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104982 being exploited in the wild.
How severe is CVE-2026-104982?: Medium severity, with a CVSS score of 4.3, published 3 October 2026.
Which products and versions are affected?: Linux Mint Xreader up to 4.6.5.
Is there a fix for CVE-2026-104982?: Yes: fixed in 4.6.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104982 attacked?: It is attacked over the network.
Am I affected by CVE-2026-104982?: Check whether you run Linux Mint Xreader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.6.6

Technical details

The EPUB file handler in backend/epub/epub-document.c fails to sanitize ../ path sequences in href attributes from the OPF manifest and navigation files. Attackers can craft EPUB archives with traversal sequences in the manifest href attributes, which are concatenated directly into file paths without validation, allowing local arbitrary file read. The attack requires only that a user opens a malicious EPUB file via the affected Xreader application.

Affected products

Linux Mint Xreader up to 4.6.5

Timeline

2026-10-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.