Cpe:2.3:a:mate-Desktop:atril:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amate-desktopatril/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 03:41:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAtril and Xreader: Path traversal and arbitrary file write (CVE-2023-52076)https://feed.craftedsignal.io/briefs/2026-10-cve-2023-52076-atrill-rce/Sun, 25 Oct 2026 03:41:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2023-52076-atrill-rce/A public exploit exists for CVE-2023-52076, a path traversal and arbitrary file write vulnerability in Atril and Xreader document viewers that enables remote code execution via malicious EPUB files.CVE-2023-52076 is a critical path traversal and arbitrary file write vulnerability affecting MATE Desktop's Atril and Cinnamon's Xreader document viewers (versions < 1.26.2). The vulnerability allows an attacker to craft a malicious EPUB file using zip-slip techniques to write files outside the extraction directory. A publicly available proof-of-concept (PoC) tool demonstrates how to leverage this flaw to inject SSH keys into 'authorized_keys' or place malicious '.desktop' files in user autostart directories, resulting in remote command execution.

Attack Chain

  1. Attacker generates a malicious EPUB document using the CVE-2023-52076 PoC script.
  2. Attacker selects an exploitation mode: SSH key injection or autostart persistence.
  3. Attacker delivers the document to the target through social engineering or public file hosting (e.g., anonymous FTP).
  4. Victim opens the document using a vulnerable version of Atril or Xreader.
  5. The application extracts the EPUB contents; the path traversal vulnerability triggers.
  6. The payload writes the malicious file (SSH key or autostart entry) into the targeted path on the victim's filesystem.
  7. In SSH mode, the attacker uses the injected key to establish unauthorized access.
  8. In autostart mode, the malicious entry executes the attacker-defined command upon the victim's next login or session start.

Recommendation

  • Update Atril and Xreader to version 1.26.2 or later immediately on all Linux systems.
  • Audit '.config/autostart/' directories for unauthorized or suspicious '.desktop' files.
  • Audit '~/.ssh/authorized_keys' files for unexpected SSH public keys.
  • Deploy file integrity monitoring (FIM) or audit logging on critical user configuration directories (e.g., ~/.ssh, ~/.config/autostart).
]]>highadvisorycve-2023-52076vulnerabilitypath-traversalrceatrilxreader