What is the CVSS score of CVE-2026-26064?

CVE-2026-26064 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows are affected by CVE-2026-26064?

Calibre versions 9.2.1 and below contain a critical path traversal vulnerability (CVE-2026-26064) that enables attackers to write arbitrary files to any location where the application has write…. A patch is available.

Is there a public PoC exploit available for CVE-2026-26064?

Yes, a public proof-of-concept exploit is available for CVE-2026-26064. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-26064?

Within 24 hours: Identify all systems running Calibre 9.2.1 or below and assess their network exposure and user access levels. Within 7 days: Apply the available vendor patch to all affected instances and verify successful deployment. Within 30 days: Conduct a security audit to confirm patch compliance across the environment and review access logs for any suspicious file write activities during the vulnerability window.

Windows CVE-2026-26064

HIGH

Path Traversal (CWE-22)

2026-02-20 security-advisories@github.com

Windows RCE Path Traversal Calibre Suse

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 20, 2026 - 16:53 vuln.today

Public exploit code

Patch released

Feb 20, 2026 - 16:53 nvd

Patch available

CVE Published

Feb 20, 2026 - 02:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith('Pictures'), and does not sanitize '..' sequences. calibre's own ZipFile.extractall() in utils/zipfile.py does sanitize '..' via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.

AnalysisAI

Remote code execution in Calibre 9.2.1 and earlier allows authenticated users to write arbitrary files via a path traversal flaw in the extract_pictures() function that fails to properly sanitize directory traversal sequences. On Windows systems, attackers can exploit this to write malicious payloads to the Startup folder, achieving code execution upon the next user login. Public exploit code exists for this vulnerability, and a patch is available in version 9.3.0.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Calibre. calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith('Pictures'), and does not sanitize '..' sequences. calibre's own ZipFile.extractall() in

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 9.3.0.. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.