CVE-2023-52076
Remote Code Execution Vulnerability in Atril's EPUB ebook parsing
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Remote Code Execution Vulnerability in Atril's EPUB ebook parsing
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.
- Record
CVE-2023-52076- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-24, CWE-25, CWE-27, CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2023-56755
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.
- Record
EUVD-2023-56755- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
NVD
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.
- Record
CVE-2023-52076- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22, CWE-24, CWE-25, CWE-27
- Updated
- 2026-11-02
OSV
Remote Code Execution Vulnerability in Atril's EPUB ebook parsing
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.
- Record
CVE-2023-52076- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-22, CWE-24, CWE-25, CWE-27
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-52076
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.
- Record
DEBIAN-CVE-2023-52076- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1245
atril security update
Mate-document-viewer is simple document viewer. It can display and print Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS), DVI, DJVU, epub and XPS files. When supported by the document format, mate-document-viewer allows searching for text, copying text to the clipboard, hypertext navigation, table-of-contents bookmarks and editing of forms.
Security Fix(es):
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.(CVE-2023-52076)
- Record
OESA-2024-1245- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVOESA-2024-1246
atril security update
Mate-document-viewer is simple document viewer. It can display and print Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS), DVI, DJVU, epub and XPS files. When supported by the document format, mate-document-viewer allows searching for text, copying text to the clipboard, hypertext navigation, table-of-contents bookmarks and editing of forms.
Security Fix(es):
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.(CVE-2023-52076)
- Record
OESA-2024-1246- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1247
atril security update
Mate-document-viewer is simple document viewer. It can display and print Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS), DVI, DJVU, epub and XPS files. When supported by the document format, mate-document-viewer allows searching for text, copying text to the clipboard, hypertext navigation, table-of-contents bookmarks and editing of forms.
Security Fix(es):
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.(CVE-2023-52076)
- Record
OESA-2024-1247- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1248
atril security update
Mate-document-viewer is simple document viewer. It can display and print Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS), DVI, DJVU, epub and XPS files. When supported by the document format, mate-document-viewer allows searching for text, copying text to the clipboard, hypertext navigation, table-of-contents bookmarks and editing of forms.
Security Fix(es):
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.(CVE-2023-52076)
- Record
OESA-2024-1248- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1249
atril security update
Mate-document-viewer is simple document viewer. It can display and print Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS), DVI, DJVU, epub and XPS files. When supported by the document format, mate-document-viewer allows searching for text, copying text to the clipboard, hypertext navigation, table-of-contents bookmarks and editing of forms.
Security Fix(es):
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.(CVE-2023-52076)
- Record
OESA-2024-1249- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1492
atril security update
Mate-document-viewer is simple document viewer. It can display and print Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS), DVI, DJVU, epub and XPS files. When supported by the document format, mate-document-viewer allows searching for text, copying text to the clipboard, hypertext navigation, table-of-contents bookmarks and editing of forms.
Security Fix(es):
Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vulnerability gives the attacker immediate access to the target system when the target user opens a crafted document or clicks on a crafted link/URL using a maliciously crafted CBT document which is a TAR archive. A patch is available at commit ce41df6. (CVE-2023-51698)
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.(CVE-2023-52076)
- Record
OESA-2024-1492- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-52076
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.
- Record
UBUNTU-CVE-2023-52076- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.5 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVMGASA-2024-0224 No score
Updated atril packages fix security vulnerability
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. (CVE-2023-52076)
- Record
MGASA-2024-0224- Updated
- 2026-11-02
OSVUSN-6808-1 No score
atril vulnerability
It was discovered that Atril was vulnerable to a path traversal attack. An attacker could possibly use this vulnerability to create arbitrary files on the host filesystem with user privileges.
- Record
USN-6808-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
atrilDebian:12 |
before 1.26.0-2+deb12u3, plus listed versions 1.26.0-21.26.0-2+deb12u11.26.0-2+deb12u2 |
1.26.0-2+deb12u3 |
atrilDebian:13 |
before 1.26.2-1 | 1.26.2-1 |
atrilDebian:14 |
before 1.26.2-1 | 1.26.2-1 |
atrilDebian:10 |
before 1.20.3-1+deb10u2, plus listed versions 1.20.3-11.20.3-1+deb10u11.20.3-1+deb10u1~bpo9+1 |
1.20.3-1+deb10u2 |
atrilDebian:11 |
before 1.24.0-1+deb11u1, plus listed versions 1.24.0-1 |
1.24.0-1+deb11u1 |
atrilMageia:9 |
before 1.26.1-1.1.mga9 | 1.26.1-1.1.mga9 |
atrilopenEuler:22.03-LTS-SP3 |
before 1.22.3-3.oe2203sp3 | 1.22.3-3.oe2203sp3 |
atrilopenEuler:20.03-LTS-SP4 |
before 1.22.3-3.oe2003sp4 | 1.22.3-3.oe2003sp4 |
atrilopenEuler:22.03-LTS |
before 1.22.3-3.oe2203 | 1.22.3-3.oe2203 |
atrilopenEuler:22.03-LTS-SP1 |
before 1.22.3-3.oe2203sp1 | 1.22.3-3.oe2203sp1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
atrilopenEuler:22.03-LTS-SP2 |
before 1.22.3-3.oe2203sp2 | 1.22.3-3.oe2203sp2 |
atrilopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 1.22.3-4.oe1 | 1.22.3-4.oe1 |
atrilUbuntu:Pro:16.04:LTS |
before 1.12.2-1ubuntu0.3+esm1, plus listed versions 1.10.2+repack1-11.12.2-11.12.2-1ubuntu0.11.12.2-1ubuntu0.21.12.2-1ubuntu0.3 |
1.12.2-1ubuntu0.3+esm1 |
atrilUbuntu:Pro:18.04:LTS |
before 1.20.1-2ubuntu2+esm1, plus listed versions 1.18.1-11.18.3-11.19.6-0ubuntu11.20.0-0ubuntu11.20.1-0ubuntu11.20.1-11.20.1-2ubuntu11.20.1-2ubuntu2 |
1.20.1-2ubuntu2+esm1 |
atrilUbuntu:20.04:LTS |
before 1.24.0-1ubuntu0.1, plus listed versions 1.22.2-0ubuntu11.24.0-0ubuntu11.24.0-1 |
1.24.0-1ubuntu0.1 |
atrilUbuntu:22.04:LTS |
before 1.26.0-1ubuntu1.1, plus listed versions 1.26.0-0ubuntu11.26.0-1ubuntu1 |
1.26.0-1ubuntu1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Groppoxx/CVE-2023-52076-PoC | 2026-07-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-52076 is a high vulnerability (CVSS 8.5) in Mate-desktop Atril, published January 25, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in atril 1.26.0-2+deb12u3.
References
github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37
lists.debian.org/debian-lts-announce/2024/06/msg00003.html
nvd.nist.gov/vuln/detail/CVE-2023-52076
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2023-52076
advisories.mageia.org/MGASA-2024-0224.html
bugs.mageia.org/show_bug.cgi?id=33282
ubuntu.com/security/notices/USN-6808-1
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1245
cve.org/CVERecord?id=CVE-2023-52076