CVE-2026-104982

A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 4.6.6 is capable of addressing this issue. Patch name: a5aecea074e8564b7a22f1ce054b31ec862974b7. It is advisable to upgrade the affected component. One of the project maintainers explains, that "EPUB support was removed from Xreader and reimplemented in Xepub".

• CWE-22

• https://gist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2
• https://github.com/linuxmint/xreader/commit/a5aecea074e8564b7a22f1ce054b31ec862974b7
• https://github.com/linuxmint/xreader/issues/713
• https://github.com/linuxmint/xreader/releases/tag/4.6.6
• https://vuldb.com/cve/CVE-2026-104982
• https://vuldb.com/submit/964347
• https://vuldb.com/vuln/413198
• https://vuldb.com/vuln/413198/cti

Published

Oct 3, 2026

Last Modified

Oct 3, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104906MISP contains a cross-site scripting (XSS) vulnerability in …6.2
• CVE-2026-104907MISP contains a cross-site scripting (XSS) vulnerability in …4.8
• CVE-2026-104908MISP contains an improper input validation vulnerability in …7.1
• CVE-2026-104910MISP contains an authorization bypass in the related events …5.3
• CVE-2026-104912MISP contains an authorization flaw in its correlation handl…7.1
• CVE-2026-104914MISP contains an improper access control vulnerability in it…5.3
• CVE-2026-104988A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST…8.1
• CVE-2026-104991Phproject before 1.8.7 contains a missing object-level autho…7.1
• CVE-2026-104994Trivy before 0.71.0 allows directory traversal in Terraform …2.5
• CVE-2026-1050A flaw has been found in risesoft-y9 Digital-Infrastructure …7.3
• CVE-2026-105029UVdesk support-center-bundle before 1.1.3.3 contains an inse…4.3
• CVE-2026-105030Kener 4.0.0 before 4.1.6 contains an information disclosure …5.3