What is the CVSS score of CVE-2026-25636?

CVE-2026-25636 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Calibre are affected by CVE-2026-25636?

Calibre e-book management software contains a critical path traversal vulnerability that allows attackers to corrupt arbitrary files through malicious EPUB files.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25636?

Yes, a public proof-of-concept exploit is available for CVE-2026-25636. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25636?

Within 24 hours: Inventory all systems running Calibre 9.1.0 and earlier; restrict EPUB file processing to trusted sources only and disable automated conversion features if possible. Within 7 days: Apply the available vendor patch to all affected Calibre installations and validate successful deployment. Within 30 days: Conduct a file integrity audit on systems that processed EPUB files during the exposure period to identify any corrupted files.

Calibre CVE-2026-25636

HIGH

Path Traversal (CWE-22)

2026-02-06 security-advisories@github.com

Path Traversal Red Hat Calibre Suse Calibre Ebook

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 17, 2026 - 21:23 vuln.today

Public exploit code

Patch released

Feb 17, 2026 - 21:23 nvd

Patch available

CVE Published

Feb 06, 2026 - 21:16 nvd

HIGH 8.2

DescriptionGitHub Advisory

calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem path and opens it in read-write mode, even when it points outside the conversion extraction directory. This vulnerability is fixed in 9.2.0.

AnalysisAI

Calibre 9.1.0 and earlier contains a path traversal vulnerability in EPUB conversion that allows malicious EPUB files to corrupt or modify arbitrary files writable by the Calibre process. The vulnerability exploits improper handling of CipherReference URIs in encryption metadata, enabling attackers to write outside the intended extraction directory. Public exploit code exists for this high-severity issue, which is patched in version 9.2.0.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Calibre. calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem path and opens it in read-write mode, even when it points outside the conversion extraction directory. This vulnerability is fixed in 9.2.0.