What’s Vulnerable › Vulnerabilities

CVE-2023-52076: Remote Code Execution Vulnerability in Atril's EPUB ebook parsing

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-25 · updated 2026-06-17
• Weakness: CWE-22

Description

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.

Affected products

• mate-desktop atril: before 1.26.2 — fixed in 1.26.2

How to fix

Upgrade to a fixed version: mate-desktop atril 1.26.2. Check the vendor advisory for mitigations.

References

• https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50
• https://github.com/mate-desktop/atril/releases/tag/v1.26.2
• https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37
• https://lists.debian.org/debian-lts-announce/2024/06/msg00003.html
• https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50
• https://github.com/mate-desktop/atril/releases/tag/v1.26.2
• https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37
• https://lists.debian.org/debian-lts-announce/2024/06/msg00003.html

Get alerted when CVE-2023-52076 or the next vulnerability affects your stack