CVE-2023-52076 Remote Code Execution Vulnerability in Atril's EPUB ebook parsing
Attackers can achieve remote code execution by crafting EPUB files that exploit path traversal to write arbitrary files in Atril.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-52076?
CVE-2023-52076 is a high-severity path traversal vulnerability in mate-desktop atril, published on 25 Jan 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.
Which versions are affected by CVE-2023-52076?
It affects 1 product.
Products include Mate-Desktop Atril.
How do I fix CVE-2023-52076?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-52076 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-52076 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in mate-desktop atril
Sources
Also known as DEBIAN-CVE-2023-52076, DLA-3828-1, DSA-5688-1, GHSA-6mf6-mxpc-jc37, MGASA-2024-0224, OESA-2024-1245 and 6 more.