What is the CVSS score of CVE-2023-51698?

CVE-2023-51698 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L. EPSS exploitation probability: 2.3%.

Which versions of Atril are affected by CVE-2023-51698?

Organizations using Atril face critical risk from CVE-2023-51698, a OS command injection vulnerability rated CVSS 9.6.. A patch is available.

Is there a public PoC exploit available for CVE-2023-51698?

Yes, a public proof-of-concept exploit is available for CVE-2023-51698. Prioritise patching immediately. EPSS: 2.3%.

How to fix or mitigate CVE-2023-51698?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Atril CVE-2023-51698

CRITICAL

OS Command Injection (CWE-78)

2024-01-12 security-advisories@github.com

Command Injection Atril

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:34 vuln.today

Patch released

Mar 28, 2026 - 19:34 nvd

Patch available

PoC Detected

Apr 10, 2025 - 20:53 vuln.today

Public exploit code

CVE Published

Jan 12, 2024 - 21:15 nvd

CRITICAL 9.6

DescriptionGitHub Advisory

Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vulnerability gives the attacker immediate access to the target system when the target user opens a crafted document or clicks on a crafted link/URL using a maliciously crafted CBT document which is a TAR archive. A patch is available at commit ce41df6.

AnalysisAI

Atril is a simple multi-page document viewer. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vulnerability gives the attacker immediate access to the target system when the target user opens a crafted document or clicks on a crafted link/URL using a maliciously crafted CBT document which is a TAR archive. A patch is available at commit ce41df6. Affected products include: Mate-Desktop Atril.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.