Is CVE-2026-104983 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104983 being exploited in the wild.

How severe is CVE-2026-104983?

Medium severity, with a CVSS score of 6.3, published 3 October 2026.

Which products and versions are affected?

Linux Mint Xreader up to 4.6.9.

How is CVE-2026-104983 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104983?

Check whether you run Linux Mint Xreader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104983: Linux Mint Xreader path traversal in PDF attachment saving

CVE-2026-104983 · Severity: medium · CVSS 6.3 · Published 2026-10-03

Xreader is a document viewer for Linux Mint that opens PDF and EPUB files. A flaw in how it saves PDF attachments allows an attacker to write malicious files to arbitrary locations on the system by crafting a PDF with specially-named attachments containing path traversal sequences. An attacker can exploit this to place executable files (like .desktop files) on the user's Desktop and achieve code execution when the user interacts with them.

Technologies: Linux Mint Xreader. Vendors: Linux Mint.

Quick answers

Is CVE-2026-104983 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104983 being exploited in the wild.
How severe is CVE-2026-104983?: Medium severity, with a CVSS score of 6.3, published 3 October 2026.
Which products and versions are affected?: Linux Mint Xreader up to 4.6.9.
Is there a fix for CVE-2026-104983?: No fixed version is recorded yet. Extract the basename of the attachment filename using g_path_get_basename() before passing it to g_file_get_child() in both the local and remote save code paths (lines 7374 and 7400 of shell/ev-window.c), ensuring attachment names cannot contain directory traversal sequences.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-104983 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104983?: Check whether you run Linux Mint Xreader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Extract the basename of the attachment filename using g_path_get_basename() before passing it to g_file_get_child() in both the local and remote save code paths (lines 7374 and 7400 of shell/ev-window.c), ensuring attachment names cannot contain directory traversal sequences.</anigation> </invoke>

Technical details

The vulnerability exists in shell/ev-window.c where the g_file_get_child() function is called with an unsanitized attachment filename containing ../ sequences, allowing directory traversal. When a user saves an attachment via "Save Attachment As...", the raw attachment name is resolved against the target directory without basename extraction, enabling writes to arbitrary filesystem locations with exact filenames. This can be exploited to write .desktop files or other executable formats to predictable locations, leading to arbitrary code execution.

Affected products

Linux Mint Xreader up to 4.6.9

Timeline

2026-03-30: disclosed: Security researcher published detailed vulnerability report with PoC
2026-05-20: advisory: Issue filed on GitHub with full technical details
2026-10-03: other: CVE-2026-104983 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.