CVE-2026-26064

published 2026-02-20

CVE-2026-26064: calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal…

Priority P2 62 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith('Pictures'), and does not sanitize '..' sequences. calibre's own ZipFile.extractall() in utils/zipfile.py does sanitize '..' via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
calibre-ebook	calibre	< 9.3.0	9.3.0
debian	calibre	< calibre 9.3.0+ds+~0.10.5-1 (forky)	calibre 9.3.0+ds+~0.10.5-1 (forky)
kovidgoyal	calibre	< 9.3.0	9.3.0
kovidgoyal	calibre	>= 0 < 9.3.0+ds+~0.10.5-1	9.3.0+ds+~0.10.5-1

Detection & IOCs extracted from sources · hover to see the quote

• → The vulnerable function `extract_pictures()` bypasses path sanitization by using manual `zf.read() + open()` instead of the safe `ZipFile.extractall()`. Detection should focus on path traversal sequences (e.g., `..`) within archive entries whose names pass a `startswith('Pictures')` check — flag any archive entry beginning with 'Pictures' that also contains '..' sequences. ↗
• → On Windows, exploitation results in a file write to the Startup folder. Monitor for unexpected file creation events in the Windows Startup folder (e.g., `C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\`) originating from the calibre process. ↗
• → Affected versions are calibre 9.2.1 and below. Identify and flag installations of calibre at or below version 9.2.1 in asset inventory. ↗

• · The vulnerability is exploitable only where the user running calibre has write permissions to the target path. On Windows, Startup folder writes lead to RCE on next login; impact on other platforms depends on writable paths available to the user. ↗
• · Debian bookworm, bullseye, and trixie remain unpatched as of the tracker snapshot. Only forky and sid have resolved packages (9.3.0+ds+~0.10.5-1). Prioritize patching on those unresolved Debian releases. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 9.3 CRITICAL CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv 9.3 CRITICAL

vendor_debian 9.3 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22