CVE-2026-104983 Linux Mint CVE debrief

Who should care

Defenders responsible for Linux Mint Xreader installations, especially those handling PDF attachments, should assess exposure and prioritize verification of affected systems. This includes reviewing system configurations, monitoring for suspicious activity, and considering updates or patches. Additionally, security teams and vulnerability management teams should be aware of the potential impacts and plan accordingly.

Why it matters

CVE-2026-104983 is a path traversal vulnerability in Linux Mint Xreader that allows remote attackers to manipulate PDF attachments. Defenders should assess exposure, prioritize verification, and consider updates or patches.

• Potential unauthorized access to sensitive data
• Possible data exposure through manipulated PDF attachments
• Need for verification of affected Xreader versions
• Prioritization of system updates or patches

Technical summary

The vulnerability is located in the g_file_get_child function of the shell/ev-window.c file in Linux Mint Xreader up to 4.6.9. It allows remote attackers to perform path traversal attacks by manipulating the attachment argument. The exploit has been publicly disclosed, but the actual impact and affected versions require further verification. This vulnerability impacts defenders who handle PDF attachments with Xreader, potentially leading to unauthorized access or data exposure. The issue arises from the handling of PDF attachments in the PDF Attachment Saving Handler.

Defensive priority

Defenders should assess exposure and prioritize verification of affected systems, especially those handling PDF attachments with Xreader.

Recommended defensive actions

• Assess exposure of Xreader installations to PDF attachment handling
• Verify system configurations and update to a fixed version if available
• Monitor for suspicious activity related to PDF attachments
• Review and adjust handling of PDF attachments in Xreader
• Perform vulnerability scanning to identify potentially affected systems
• Review system logs for indicators of compromise related to PDF attachments
• Implement additional security controls to mitigate potential impacts

Evidence notes

The vulnerability was disclosed publicly, and its details are available in the CVE record and other sources. However, the actual impact and affected versions require further verification. Linux Mint Xreader up to 4.6.9 is impacted, specifically in the PDF Attachment Saving Handler. The issue is located in the function g_file_get_child of the file shell/ev-window.c. This vulnerability allows remote attackers to manipulate the argument attachment, potentially leading to unauthorized access or data exposure. The exploit has been publicly

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.