What’s Vulnerable › Vulnerabilities

CVE-2026-25636: calibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-06 · updated 2026-06-17
• Weakness: CWE-22

Description

calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem path and opens it in read-write mode, even when it points outside the conversion extraction directory. This vulnerability is fixed in 9.2.0.

Affected products

• kovidgoyal calibre: before 9.2.0 — fixed in 9.2.0

How to fix

Upgrade to a fixed version: kovidgoyal calibre 9.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/kovidgoyal/calibre/commit/9484ea82c6ab226c18e6ca5aa000fa16de598726
• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-8r26-m7j5-hm29
• https://0x5t.raptx.org/posts/calibre-epub-rce

Get alerted when CVE-2026-25636 or the next vulnerability affects your stack