# CVE-2023-52076: Remote Code Execution Vulnerability in Atril's EPUB ebook parsing

> Attackers can achieve remote code execution by crafting EPUB files that exploit path traversal to write arbitrary files in Atril.

- **Severity:** High 8.5 (`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 25 Jan 2024
- **Updated:** 17 Jun 2025
- **Also known as:** DEBIAN-CVE-2023-52076, DLA-3828-1, DSA-5688-1, GHSA-6mf6-mxpc-jc37, MGASA-2024-0224, OESA-2024-1245, OESA-2024-1246, OESA-2024-1247, OESA-2024-1248, OESA-2024-1249, UBUNTU-CVE-2023-52076, USN-6808-1

## What is CVE-2023-52076?

CVE-2023-52076 is a high-severity path traversal vulnerability in mate-desktop atril, published on 25 Jan 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.

Weakness: CWE-27 (Path Traversal: 'dir/../../filename'), CWE-25 (Path Traversal: '/../filedir'), CWE-24 (Path Traversal: '../filedir'), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)

## Which versions are affected by CVE-2023-52076?

It affects 1 product.


Products: Mate-Desktop Atril.

## How do I fix CVE-2023-52076?

Apply the vendor's patch.

## Is CVE-2023-52076 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-52076 exists.

Public exploit code:

- PoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary file write and RCE via crafted EPUB. Authorized security testing only. (github_poc): https://github.com/Groppoxx/CVE-2023-52076-PoC

## Other vulnerabilities in mate-desktop atril

- [CVE-2023-51698](https://insights.sbomify.com/CVE-2023-51698/): Atril's CBT comic book parsing vulnerable to Remote Code Execution (critical 9.6)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2023-52076 and fix it if it is affected.

What it is: CVE-2023-52076 is a high-severity path traversal vulnerability in mate-desktop atril, published on 25 Jan 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-52076 exists.

Affected product: mate-desktop atril. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2023-52076/ (Markdown: https://insights.sbomify.com/CVE-2023-52076/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2023-52076
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52076
- OSV: https://osv.dev/vulnerability/CVE-2023-52076

---
From sbomify Insights: https://insights.sbomify.com/CVE-2023-52076/
Summaries are generated and may contain mistakes; the official description above is the record.