What is the CVSS score of CVE-2026-25731?

CVE-2026-25731 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-25731?

Yes, a public proof-of-concept exploit is available for CVE-2026-25731. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25731?

Within 24 hours: Identify all systems running Calibre and assess exposure scope. Within 7 days: Apply the available vendor patch to all affected instances and verify successful deployment. Within 30 days: Conduct post-patch validation and document remediation evidence for compliance records.

Calibre CVE-2026-25731

HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-02-06 security-advisories@github.com

RCE Red Hat Calibre Suse Calibre Ebook

7.8

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Create malicious custom template file
Exploit

Supply via --template-html option during ebook conversion
Execution

Templite engine processes injected expressions
Impact

Execute arbitrary code with user privileges

Vulnerability Assessment

Weakness	CWE CWE-1336 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V1 - Encoding and Sanitization Template injection prevention
Exploitation Conditions	Local access required. User must manually initiate ebook conversion using --template-html or --template-html-index command-line options with attacker-controlled template file. Calibre versions prior to 9.2.0.
Impact	CVSS 7.8 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: None. User interaction: Required. Public exploit/POC available.
Exploit ScenarioDerived	An attacker could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

calibre is an e-book manager. [CVSS 7.8 HIGH]

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 9.2.0..

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Affects Calibre. calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template-html or --template-html-index command-line options. This vulnerability is fixed in 9.2.0.

Know when Calibre gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE HIGH

Red Hat 7.8 HIGH

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Feb 17, 2026 - 21:18 vuln.today

Public exploit code

Patch released

Feb 17, 2026 - 21:18 nvd

Patch available

CVE Published

Feb 06, 2026 - 21:16 nvd

HIGH 7.8

DescriptionGitHub Advisory

calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template-html or --template-html-index command-line options. This vulnerability is fixed in 9.2.0.

Executive ViewAI

Why It Matters

CVE-2026-25731 is a high-severity vulnerability in Calibre e-book management software that could allow attackers to compromise systems where the application is installed. Organizations using Calibre for document management should prioritize patching to prevent potential unauthorized access or data exposure.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.0%

Top 99% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:calibre-ebook:calibre:*:*:*:*:*:*:*:*

More in Calibre

View all

CVE-2026-26064 HIGH This Week POC

8.8 Feb 20

Remote code execution in Calibre 9.2.1 and earlier allows authenticated users to write arbitrary files via a path traver

CVE-2026-26065 HIGH This Week POC

8.8 Feb 20

Calibre versions 9.2.1 and below allow authenticated users to write arbitrary files with any extension to any writable l

CVE-2026-25635 HIGH This Week POC

8.6 Feb 06

Remote code execution in Calibre prior to version 9.2.0 through a path traversal flaw in the CHM reader allows local att

CVE-2026-25636 HIGH This Week POC

8.2 Feb 06

Calibre 9.1.0 and earlier contains a path traversal vulnerability in EPUB conversion that allows malicious EPUB files to

CVE-2018-7889 HIGH This Week POC

7.8 Mar 08

gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attacke

CVE-2024-6781 HIGH This Week POC

7.5 Aug 06

Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read. Rated high severity

CVE-2023-46303 HIGH This Week POC

7.5 Oct 22

link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources ou

CVE-2021-44686 HIGH This Week POC

7.5 Dec 07

calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) i

CVE-2024-7009 HIGH This Week POC

7.1 Aug 06

Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL in

CVE-2026-27810 MEDIUM This Month POC

6.4 Feb 27

HTTP response header injection in Calibre Content Server prior to version 9.4.0 permits authenticated users to inject ar

CVE-2024-7008 MEDIUM This Month POC

6.1 Aug 06

Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting. Rated medium seve

CVE-2016-10187 MEDIUM This Month POC

5.5 Mar 16

The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with Ja

Same weakness CWE-1336 – Improper Neutralization of Special Elements Used in a Template Engine

View all

CVE-2024-23692 CRITICAL POC

9.8

CVE-2025-47916 CRITICAL POC

10.0

CVE-2025-49619 HIGH POC

8.5

CVE-2024-6386 CRITICAL POC

9.9

CVE-2026-75650 CRITICAL POC

10.0

CVE-2025-69516 HIGH POC

8.8

CVE-2025-49136 CRITICAL POC

9.0

CVE-2025-53833 CRITICAL POC

10.0

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: High

References

Advisories & patches

PATCH https://github.com/kovidgoyal/calibre/commit/f0649b27512e987b95fcab2e1e0a3bcdafc23379

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back