CVE-2023-52076

Remote Code Execution Vulnerability in Atril's EPUB ebook parsing

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.

Atril Document Viewer es el lector de documentos predeterminado del entorno de escritorio MATE para Linux. Existe una vulnerabilidad de path traversal y escritura de archivos arbitrarios en versiones de Atril anteriores a la 1.26.2. Esta vulnerabilidad es capaz de escribir archivos arbitrarios en cualquier parte del sistema de archivos al que tiene acceso el usuario que abre un documento manipulado. La única limitación es que esta vulnerabilidad no se puede aprovechar para sobrescribir archivos existentes, pero eso no impide que un atacante logre la ejecución remota de comandos en el sistema de destino. La versión 1.26.2 de Atril contiene un parche para esta vulnerabilidad.

It was discovered that Atril was vulnerable to a path traversal attack. An attacker could possibly use this vulnerability to create arbitrary files on the host filesystem with user privileges.

*Credits: N/A

CVSS Scores

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-12-26 CVE Reserved
2024-01-25 CVE Published
2025-01-31 EPSS Updated
2025-02-13 CVE Updated
2025-02-13 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-24: Path Traversal: '../filedir'
CWE-25: Path Traversal: '/../filedir'
CWE-27: Path Traversal: 'dir/../../filename'

CAPEC

References (4)

URL	Tag	Source
https://github.com/mate-desktop/atril/releases/tag/v1.26.2	Release Notes
https://lists.debian.org/debian-lts-announce/2024/06/msg00003.html

URL	Date	SRC
https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37	2025-02-13

URL	Date	SRC
https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50	2024-06-15

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mate-desktop Search vendor "Mate-desktop"		Atril Search vendor "Mate-desktop" for product "Atril"				< 1.26.2 Search vendor "Mate-desktop" for product "Atril" and version " < 1.26.2"		-		Affected