What’s Vulnerable › Vulnerabilities

CVE-2026-25635: calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-06 · updated 2026-06-17
• Weakness: CWE-22

Description

calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows (haven't tested on other OS's), this can lead to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. This vulnerability is fixed in 9.2.0.

Affected products

• kovidgoyal calibre: before 9.2.0 — fixed in 9.2.0

How to fix

Upgrade to a fixed version: kovidgoyal calibre 9.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/kovidgoyal/calibre/commit/9739232fcb029ac15dfe52ccd4fdb4a07ebb6ce9
• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-32vh-whvh-9fxr
• https://0x5t.raptx.org/posts/calibre-chm-rce

Get alerted when CVE-2026-25635 or the next vulnerability affects your stack