CVE-2023-52076

Katalog CVE

CVSS 7.8 · High EPSS 1,1%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada mate-desktop atril. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.

Rincian

Terbit di NVD

25 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-24: Path Traversal: '../filedir'
CWE-25: Path Traversal: '/../filedir'
CWE-27: Path Traversal: 'dir/../../filename'

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37 exploit · advisory vendor
• https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50 patch
• https://github.com/mate-desktop/atril/releases/tag/v1.26.2 release notes
• https://lists.debian.org/debian-lts-announce/2024/06/msg00003.html