{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-52076 exists.","fix":"Apply the vendor's patch.","what":"CVE-2023-52076 is a high-severity path traversal vulnerability in mate-desktop atril, published on 25 Jan 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2023-52076 and fix it if it is affected.\n\nWhat it is: CVE-2023-52076 is a high-severity path traversal vulnerability in mate-desktop atril, published on 25 Jan 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-52076 exists.\n\nAffected product: mate-desktop atril. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-52076/ (Markdown: https://insights.sbomify.com/CVE-2023-52076/index.md)","id":"CVE-2023-52076","markdown":"https://insights.sbomify.com/CVE-2023-52076/index.md","name":"CVE-2023-52076","record":{"aliases":["DEBIAN-CVE-2023-52076","DLA-3828-1","DSA-5688-1","GHSA-6mf6-mxpc-jc37","MGASA-2024-0224","OESA-2024-1245","OESA-2024-1246","OESA-2024-1247","OESA-2024-1248","OESA-2024-1249","UBUNTU-CVE-2023-52076","USN-6808-1"],"analysis":{"component_type":"desktop_application","fix_type":"patch","impacts":["code_execution","data_modify"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Atril document viewer","requires_auth":"none","summary":"Attackers can achieve remote code execution by crafting EPUB files that exploit path traversal to write arbitrary files in Atril.","user_interaction":"required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"atril","vendor":"mate-desktop"}],"cvss":{"score":8.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","version":"3.1"},"cwes":[{"id":"CWE-27","name":"Path Traversal: 'dir/../../filename'"},{"id":"CWE-25","name":"Path Traversal: '/../filedir'"},{"id":"CWE-24","name":"Path Traversal: '../filedir'"},{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-07-27","github_poc":1,"max_poc_stars":3,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-07-27T06:51:21Z","kind":"github_poc","ref":"https://github.com/Groppoxx/CVE-2023-52076-PoC","stars":3,"title":"PoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary file write and RCE via crafted EPUB. Authorized security testing only."}],"tier":"weaponised"},"has_fix":true,"headline":"Remote Code Execution Vulnerability in Atril's EPUB ebook parsing","id":"CVE-2023-52076","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"path_traversal","year":"2023"},"n_packages":0,"n_references":4,"next":{"headline":"External apps using tokens issued by administrators and moderators can call admin APIs","id":"CVE-2023-52077"},"packages":[],"prev":{"headline":"ReVanced API vulnerable to Denial of Service due to lack of error caching","id":"CVE-2023-52075"},"products":["atril"],"published":"2024-01-25","related":[{"cvss_score":9.6,"headline":"Atril's CBT comic book parsing vulnerable to Remote Code Execution","id":"CVE-2023-51698","kev_date_added":null,"published":"2024-01-12"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-06-17","vendors":["mate-desktop"]},"summary":"Attackers can achieve remote code execution by crafting EPUB files that exploit path traversal to write arbitrary files in Atril.","url":"https://insights.sbomify.com/CVE-2023-52076/"}