CVE-2026-33206: calibre has a path traversal vulnerability

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-27 · updated 2026-10-26
Weakness: CWE-23

Description

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a path traversal vulnerability exists in Calibre' handling of images in Markdown and other similar text-based files allowing an attacker to include arbitrary files from the file system into the converted book. Additionally, missing authentication and server-side request forgery in the background-image endpoint in the ebook reader web view allow the files to be exfiltrated without additional interaction. Version 9.6.0 contains a fix.

Affected products

kovidgoyal calibre: before 9.6.0 — fixed in 9.6.0

How to fix

Upgrade to a fixed version: kovidgoyal calibre 9.6.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33206 or the next vulnerability affects your stack