CVE-2026-26064: critical vulnerability in kovidgoyal calibre
calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 1.0%
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith('Pictures'), and does not sanitize '..' sequences. calibre's own ZipFile.extractall() in utils/zipfile.py does sanitize '..' via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
kovidgoyal · calibreRelated CVEs — kovidgoyal calibre
In the same product, most dangerous first.
CVE-2026-26065CRITICALcalibre: Path Traversal can Lead to Arbitrary File Write and Potential Code ExecutionEPSS 0.6%CVE-2026-25635HIGHcalibre has a Path Traversal Leading to Arbitrary File Write and Potential Code ExecutionEPSS 0.5%CVE-2026-73249HIGHcalibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation ModificationEPSS 0.4%CVE-2026-25731HIGHCalibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML ExportEPSS 0.3%CVE-2026-27810MEDIUMcalibre Vulnerable to HTTP Response Header InjectionEPSS 0.2%CVE-2026-25636HIGHcalibre has a Path Traversal Leading to Arbitrary File Corruption and Code ExecutionEPSS 0.2%