CVE-2023-44451 is a high severity path traversal flaw in how Linux Mint Xreader extracts EPUB files, scored 7.8. The record lists Xreader 3.8.2 as affected and links the upstream fix commit. No fixed release number was in the sources, so update through Linux Mint and check the Xreader changelog.
What's affected
The NVD record lists Linux Mint Xreader 3.8.2 as affected. The ZDI advisory ZDI-23-1835 (ZDI-CAN-21897), dated 20 December 2023, says Linux Mint has issued an update and points to the upstream commit titled "epub: Prevent path traversal when extracting files". Neither source names the release number that first contains it.
NVD scores the flaw 7.8 with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and ZDI publishes the same. The record text describes remote attackers, while the vector is local with user interaction. The reading that fits both is that the attacker delivers a file and the user opens it.
The flaw is in EPUB parsing. The software does not validate a path taken from the file before using it in file operations, which lets contents land outside the folder meant for them. Code then runs in the context of the current user. The sibling record CVE-2023-44452 covers a separate bug in comic book archive handling in the same program.
Xreader ships in Linux Mint and is also packaged by other distributions. The version a distribution reports may not match upstream numbering, so compare against your distribution security notices as well.
Weakness class: CWE-22 (path traversal).
How to check if you're exposed
Read the installed version:
xreader --version
On Debian based systems, apt policy xreader shows both the installed and candidate versions. On Linux Mint, the Update Manager lists pending Xreader updates. If the installed version is 3.8.2 or earlier, update now and then check the changelog or the commit history of the project for the first release that includes the EPUB fix.
What to do now
- Find systems with Xreader installed, mainly Linux Mint desktops and any distribution that packages it.
- Run your package manager update and install the newest Xreader.
- Confirm from the project changelog that the version you reach contains the EPUB path traversal fix.
- Until updated, open EPUB files only from sources you trust, or use another reader.
- Remind users that an EPUB from an unknown sender is a file like any other and can carry an attack.
Why it matters
Path traversal, tracked as CWE-22, happens when a program builds a file path from data in an untrusted file and does not stop it from escaping the intended directory. EPUB files are zip archives, so the program writes archive entries to disk. If an entry name can contain parent directory references, the write can land somewhere sensitive.
The impact depends on what the user account can write to. A successful write into a startup folder or a configuration file can turn into code execution later. This is a desktop issue that needs a user to open a file. CVE-2023-44451 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
If your team ships software that extracts archives, add a check on extracted paths to your review list. Safeguard's free in-browser dependency scan can show the libraries you use for that work.
Quick check
Which Xreader release fixes CVE-2023-44451?
The sources do not name one. The upstream commit "epub: Prevent path traversal when extracting files" is the fix, so check the changelog for the first release containing it.
Is this remote?
The record text says remote attackers, but the vector is local and needs the user to open a file. Treat it as a malicious file risk.
Sources
Last reviewed: 19 October 2026.
