CVE-2023-44451highCWE-22

CVE-2023-44451: high-severity vulnerability in Linux Mint Xreader

Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability

Published · Updated

Follow this CVE+ Monitor Xreader

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 1.8%
Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EPUB files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21897.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Linux Mint · Xreader
Related CVEs — Linux Mint Xreader

In the same product, most dangerous first.

CVE-2023-44452HIGHLinux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution VulnerabilityEPSS 1.3%CVE-2026-104982MEDIUMLinux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversalEPSS 0.4%CVE-2026-104983MEDIUMLinux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversalEPSS 0.4%