CVE-2026-30853

published 2026-03-13

CVE-2026-30853: calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the…

Priority P3 41 high 8.2 CVSS 3.1

AV L AC L PR N UI R S C C N I H A H

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py) allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a crafted .rb file. This is the same bug class fixed in CVE-2026-26065 for the PDB readers, but the fix was never applied to the RB reader. This vulnerability is fixed in 9.5.0.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
calibre-ebook	calibre	< 9.5.0	9.5.0
calibre-ebook	calibre	>= 0 < 9.5.0+ds+~0.10.5-1	9.5.0+ds+~0.10.5-1
debian	calibre	< calibre 9.5.0+ds+~0.10.5-1 (forky)	calibre 9.5.0+ds+~0.10.5-1 (forky)

CVSS provenance

nvd v3.1 8.2 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

osv 9.3 CRITICAL

vendor_debian 9.3 CRITICAL

vendor_redhat 9.3 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22