Skip to main content

Atril Document Viewer EUVDEUVD-2026-36109

| CVE-2026-46529 HIGH
Command Injection (CWE-77)
2026-05-27
Command Injection Nginx Apache
8.4
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.8 HIGH

Malicious file must be opened locally by the user (AV:L, UI:R), no auth needed (PR:N); successful exploitation yields full code execution as the user, so C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE
7.0 HIGH
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

6
Patch available
Jun 10, 2026 - 21:16 EUVD
Source Code Evidence Fetched
Jun 10, 2026 - 20:25 vuln.today
Analysis Generated
Jun 10, 2026 - 20:25 vuln.today
CVSS changed
Jun 10, 2026 - 20:22 NVD
8.4 (HIGH)
CVE Published
May 27, 2026 - 20:45 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 20:45 nvd
HIGH 8.4

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Command injection in Atril (MATE document viewer) and related forks Evince/Xreader allows attackers to execute arbitrary shell commands when a victim opens a maliciously crafted document. The fix, shipped in Atril 1.26.3 and 1.28.4, quotes user-supplied strings passed to the ev_spawn command line, indicating unsanitized input was being interpolated into a spawned subprocess. No public exploit identified at time of analysis, but disclosure on oss-security and Debian LTS advisories suggests Linux desktop distributions are actively patching.

Technical ContextAI

Atril is the document viewer for the MATE desktop environment, forked from GNOME's Evince; Xreader is the Cinnamon/Linux Mint fork from the same lineage. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command): the ev_spawn helper, used to launch external helper programs (e.g., for opening attachments or links embedded in documents like PDF or EPUB), interpolated attacker-controlled metadata into a shell command line without quoting. The upstream commit referenced in the 1.26.3 changelog ('ev-application: Quote user-supplied strings in ev_spawn command line') confirms the fix is shell-quoting at the spawn boundary rather than redesigning the command pipeline.

RemediationAI

Upgrade Atril to 1.26.3 or 1.28.4 (or later) from https://github.com/mate-desktop/atril/releases, and consult vendor advisory https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f; Debian/Ubuntu users should apply the LTS updates announced at https://lists.debian.org/debian-lts-announce/2026/05/msg00041.html and msg00042.html, and Evince/Xreader users should pull their distribution's coordinated fix. As a workaround until patches are deployed, avoid opening untrusted PDF/EPUB/document files in Atril, Evince, or Xreader and instead use a sandboxed viewer such as a browser PDF viewer or a Flatpak-confined alternative - the trade-off is loss of MATE/Cinnamon integration and some format support. Disabling launch of external helpers (links/attachments) within the viewer settings, where available, reduces but may not eliminate the attack surface.

More in Nginx

View all
CVE-2013-2028 HIGH POC
7.5 Jul 20

The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
CVE-2025-1974 CRITICAL POC
9.8 Mar 25

A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
CVE-2013-4547 HIGH POC
7.5 Nov 23

nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
CVE-2023-50919 CRITICAL POC
9.8 Jan 12

An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2017-7529 HIGH
7.5 Jul 13

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
CVE-2016-0742 HIGH
7.5 Feb 15

The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
CVE-2025-1098 HIGH POC
8.8 Mar 25

Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress

CVE-2025-24514 HIGH POC
8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
CVE-2025-1097 HIGH POC
8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
CVE-2022-31137 CRITICAL POC
9.8 Jul 08

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
CVE-2014-3556 MEDIUM
6.8 Dec 29

The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and

CVE-2026-42945 CRITICAL POC
9.2 May 13

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8
CVE-2025-10035 CRITICAL POC
10.0

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

Share

EUVD-2026-36109 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy