CVE-2023-52076

Atril Document Viewer is the default document reader of the MATE desktop
environment for Linux. A path traversal and arbitrary file write
vulnerability exists in versions of Atril prior to 1.26.2. This
vulnerability is capable of writing arbitrary files anywhere on the
filesystem to which the user opening a crafted document has access. The
only limitation is that this vulnerability cannot be exploited to overwrite
existing files, but that doesn’t stop an attacker from achieving Remote
Command Execution on the target system. Version 1.26.2 of Atril contains a
patch for this vulnerability.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061522&gt;