What is the CVSS score of CVE-2026-25636?

CVE-2026-25636 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Calibre are affected by CVE-2026-25636?

Calibre e-book management software contains a critical path traversal vulnerability that allows attackers to corrupt arbitrary files through malicious EPUB files.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25636?

Yes, a public proof-of-concept exploit is available for CVE-2026-25636. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25636?

Within 24 hours: Inventory all systems running Calibre 9.1.0 and earlier; restrict EPUB file processing to trusted sources only and disable automated conversion features if possible. Within 7 days: Apply the available vendor patch to all affected Calibre installations and validate successful deployment. Within 30 days: Conduct a file integrity audit on systems that processed EPUB files during the exposure period to identify any corrupted files.

Calibre CVE-2026-25636

HIGH

Path Traversal (CWE-22)

2026-02-06 security-advisories@github.com

Path Traversal Calibre Red Hat Suse

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 17, 2026 - 21:23 vuln.today

Public exploit code

Patch released

Feb 17, 2026 - 21:23 nvd

Patch available

CVE Published

Feb 06, 2026 - 21:16 nvd

HIGH 8.2

DescriptionGitHub Advisory

calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem path and opens it in read-write mode, even when it points outside the conversion extraction directory. This vulnerability is fixed in 9.2.0.

AnalysisAI

Calibre 9.1.0 and earlier contains a path traversal vulnerability in EPUB conversion that allows malicious EPUB files to corrupt or modify arbitrary files writable by the Calibre process. The vulnerability exploits improper handling of CipherReference URIs in encryption metadata, enabling attackers to write outside the intended extraction directory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious EPUB with path traversal in encryption.xml

Delivery

User opens EPUB in Calibre conversion

Exploit

CipherReference URI resolves to arbitrary file path

Execution

Calibre opens file in read-write mode

Impact

Attacker corrupts arbitrary files

Access

Craft malicious EPUB with path traversal in encryption.xml

Delivery

User opens EPUB in Calibre conversion

Exploit

CipherReference URI resolves to arbitrary file path

Execution

Calibre opens file in read-write mode

Impact

Attacker corrupts arbitrary files

Vulnerability AssessmentAI

Exploitation	Calibre versions 9.1.0 and earlier with EPUB conversion feature enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 8.2 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker could exploit this vulnerability to compromise the affected system.
Remediation	A vendor patch is available — apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all systems running Calibre 9.1.0 and earlier; restrict EPUB file processing to trusted sources only and disable automated conversion features if possible. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

SUSE

Severity: High

CVE-2026-25636 vulnerability details – vuln.today

Back

Calibre CVE-2026-25636

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code