{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/xreader--1.26.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mate-desktop:atril:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2023-52076"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Atril (\u003c 1.26.2)","Xreader (\u003c 1.26.2)"],"_cs_severities":["high"],"_cs_tags":["cve-2023-52076","vulnerability","path-traversal","rce","atril","xreader"],"_cs_type":"advisory","_cs_vendors":["MATE Desktop","Linux Mint"],"content_html":"\u003cp\u003eCVE-2023-52076 is a critical path traversal and arbitrary file write vulnerability affecting MATE Desktop's Atril and Cinnamon's Xreader document viewers (versions \u0026lt; 1.26.2). The vulnerability allows an attacker to craft a malicious EPUB file using zip-slip techniques to write files outside the extraction directory. A publicly available proof-of-concept (PoC) tool demonstrates how to leverage this flaw to inject SSH keys into 'authorized_keys' or place malicious '.desktop' files in user autostart directories, resulting in remote command execution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker generates a malicious EPUB document using the CVE-2023-52076 PoC script.\u003c/li\u003e\n\u003cli\u003eAttacker selects an exploitation mode: SSH key injection or autostart persistence.\u003c/li\u003e\n\u003cli\u003eAttacker delivers the document to the target through social engineering or public file hosting (e.g., anonymous FTP).\u003c/li\u003e\n\u003cli\u003eVictim opens the document using a vulnerable version of Atril or Xreader.\u003c/li\u003e\n\u003cli\u003eThe application extracts the EPUB contents; the path traversal vulnerability triggers.\u003c/li\u003e\n\u003cli\u003eThe payload writes the malicious file (SSH key or autostart entry) into the targeted path on the victim's filesystem.\u003c/li\u003e\n\u003cli\u003eIn SSH mode, the attacker uses the injected key to establish unauthorized access.\u003c/li\u003e\n\u003cli\u003eIn autostart mode, the malicious entry executes the attacker-defined command upon the victim's next login or session start.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Atril and Xreader to version 1.26.2 or later immediately on all Linux systems.\u003c/li\u003e\n\u003cli\u003eAudit '.config/autostart/' directories for unauthorized or suspicious '.desktop' files.\u003c/li\u003e\n\u003cli\u003eAudit '~/.ssh/authorized_keys' files for unexpected SSH public keys.\u003c/li\u003e\n\u003cli\u003eDeploy file integrity monitoring (FIM) or audit logging on critical user configuration directories (e.g., ~/.ssh, ~/.config/autostart).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T03:41:33Z","date_published":"2026-10-25T03:41:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2023-52076-atrill-rce/","summary":"A public exploit exists for CVE-2023-52076, a path traversal and arbitrary file write vulnerability in Atril and Xreader document viewers that enables remote code execution via malicious EPUB files.","title":"Atril and Xreader: Path traversal and arbitrary file write (CVE-2023-52076)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2023-52076-atrill-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Xreader (\u003c 1.26.2)","version":"https://jsonfeed.org/version/1.1"}