Calibre
CVE-2026-26065
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUpload malicious PDB e-book file
-
DeliveryPDB reader parses path traversal payload
-
ExploitArbitrary file written to traversed directory
-
ExecutionExisting files silently overwritten
-
ImpactCode execution or DoS achieved
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Calibre versions 9.2.1 and below with PDB reader functionality enabled. Attacker must be authenticated user (PR:L) able to upload or import PDB e-book files (132-byte or 202-byte header variants). Write permissions required on target filesystem directories. |
| Impact | CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to potential code execution and Denial of Service through file corruption. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Calibre versions 9.2.1 and below allow authenticated users to write arbitrary files with any extension to any writable location via path traversal in PDB file readers, potentially enabling code execution or system compromise through file overwriting. The vulnerability affects both 132-byte and 202-byte PDB header variants and silently overwrites existing files without warning. Public exploit code exists and patches are available in version 9.3.0 and later.
Earlier versions of this analysis (1)
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. [CVSS 8.8 HIGH]
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 9.3.0.. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-22 (Path Traversal). Affects Calibre. calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruptio
Know when Calibre gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruption. This issue has been fixed in version 9.3.0.
Executive ViewAI
A high-severity vulnerability (CVE-2026-26065) in Calibre e-book management software poses a significant risk to organizations using this tool for document management and conversion. With a CVSS score of 8.8 and public exploits available, immediate patching is critical to prevent potential unauthorized access, data exfiltration, or system compromise across affected systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Remote code execution in Calibre 9.2.1 and earlier allows authenticated users to write arbitrary files via a path traver
Remote code execution in Calibre prior to version 9.2.0 through a path traversal flaw in the CHM reader allows local att
Calibre 9.1.0 and earlier contains a path traversal vulnerability in EPUB conversion that allows malicious EPUB files to
calibre is an e-book manager. [CVSS 7.8 HIGH]
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attacke
Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read. Rated high severity
link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources ou
calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) i
Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL in
HTTP response header injection in Calibre Content Server prior to version 9.4.0 permits authenticated users to inject ar
Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting. Rated medium seve
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with Ja
Exploit-DB