CVE-2023-52076

HIGH EXPLOITED

Atril Document Viewer <1.26.2 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-52076 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Groppoxx.

AI-analyzed exploit summary This PoC exploits CVE-2023-52076, a path traversal and arbitrary file write vulnerability in Atril/Xreader document viewers (MATE Desktop). The exploit crafts a malicious EPUB file with zip-slip paths targeting SSH authorized_keys or autostart .desktop files to achieve remote command execution or SSH key injection.

Description

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.

Exploits (2)

nomisec WORKING POC 2 stars
by Groppoxx · client-side
https://github.com/Groppoxx/CVE-2023-52076-PoC

This PoC exploits CVE-2023-52076, a path traversal and arbitrary file write vulnerability in Atril/Xreader document viewers (MATE Desktop). The exploit crafts a malicious EPUB file with zip-slip paths targeting SSH authorized_keys or autostart .desktop files to achieve remote command execution or SSH key injection.

Classification
Working Poc 98%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Atril/Xreader (MATE Desktop document viewers)
No auth needed
Prerequisites: Victim must open the crafted EPUB/PDF file in Atril/Xreader · For autostart mode: victim must logout/login to trigger the payload · For SSH mode: target system must have SSH enabled and writable .ssh directory
mistral-large-3 · analyzed Jul 27, 2026 Full analysis →
vulncheck_xdb WORKING POC
client-side
https://github.com/febinrev/slippy-book-exploit

This repository contains functional exploit scripts for CVE-2023-52076, a directory traversal vulnerability in Atril/Xreader document viewers. The exploit leverages EPUB file parsing to achieve arbitrary file write and RCE via crafted .desktop entries or SSH authorized_keys.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Atril Document Viewer, Xreader Document Viewer (MATE, Linux Mint)
No auth needed
Prerequisites: crafted EPUB file · user interaction to open the file
mistral-large-3 · analyzed Feb 25, 2026 Full analysis →

Scores

CVSS v3 8.5
EPSS 0.0102
EPSS Percentile 59.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

VulnCheck KEV 2025-12-08
CWE
CWE-22 CWE-24 CWE-25 CWE-27
Status published
Products (1)
mate-desktop/atril < 1.26.2
Published Jan 25, 2024
Tracked Since Feb 18, 2026