CVE-2023-52076 is a high severity (8.5 CVSS) path traversal and arbitrary file write in Atril, the document viewer of the MATE desktop. A crafted document can write new files anywhere the user can write. The fix is Atril 1.26.2, per the project's release notes and the NVD record.
What's affected
The NVD record says versions of Atril before 1.26.2 are affected and that 1.26.2 contains the patch. The project's GitHub advisory page we fetched reads the ranges as less than or equal to 1.6.1 and fixed in 1.6.2 or later, which looks like a typo for 1.26.x. Treat the NVD text and the release tag v1.26.2 as the authoritative fixed version, and confirm against your distribution.
Debian LTS also published an announcement for this CVE, so Debian based systems may carry a backported fix under a different package version. Check your distribution's security tracker rather than the upstream number alone.
How to check if you're exposed
On most Linux desktops you can read the installed version directly.
atril --version
On Debian or Ubuntu you can also query the package.
dpkg -l atril
On Fedora style systems use rpm -q atril. If the upstream version is below 1.26.2, check whether your distribution backported the fix before deciding you are exposed.
What to do now
- Update Atril to 1.26.2 or later, or install your distribution's patched package.
- Until then, avoid opening untrusted EPUB or PDF files in Atril. The advisory says a crafted file renamed to .pdf is still parsed as an EPUB, so the file extension is not a safe signal.
- Consider opening unknown documents in a different viewer or a sandboxed account on shared machines.
- Review the GitHub advisory and the release notes.
Why it matters
The record maps the issue to CWE-22, with related path handling weaknesses CWE-24, CWE-25 and CWE-27. In plain terms, the EPUB parser trusts file names inside the archive and lets them point outside the folder where the viewer meant to unpack them.
The advisory says the bug cannot overwrite existing files, but notes that writing a new file in the right place is still enough to reach command execution. The vector is local and needs the user to open a document, so the realistic path is a phishing style attachment. The KEV flag is false. Severity note: the NVD record scores it 8.5 High, while the advisory text itself uses the word critical in its description even though its badge says High.
For a wider view, the free in-browser dependency scan and the Gold directory help you see which packaged components in your own code carry known CVEs, and reachability analysis helps you decide which ones matter first.
Quick check
Is renaming the file to .pdf a safe workaround?
No. The advisory says a crafted file renamed to .pdf is still parsed as an EPUB, so the extension does not protect you. Upgrade instead.
Sources
Last reviewed: 19 October 2026.
