What is the CVSS score of CVE-2026-26065?

CVE-2026-26065 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Calibre are affected by CVE-2026-26065?

A high-severity vulnerability (CVE-2026-26065) in Calibre e-book management software poses a significant risk to organizations using this tool for document management and conversion.. A patch is available.

Is there a public PoC exploit available for CVE-2026-26065?

Yes, a public proof-of-concept exploit is available for CVE-2026-26065. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26065?

Within 24 hours: Inventory all systems running Calibre and assess business criticality. Within 7 days: Apply vendor patch to all Calibre installations, prioritizing systems handling sensitive e-books or integrated with critical workflows. Within 30 days: Verify patch deployment across the entire environment and conduct post-remediation security testing to confirm vulnerability closure.

Calibre CVE-2026-26065

HIGH

Path Traversal (CWE-22)

2026-02-20 security-advisories@github.com

Denial Of Service Path Traversal Calibre Suse

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 20, 2026 - 16:45 vuln.today

Public exploit code

Patch released

Feb 20, 2026 - 16:45 nvd

Patch available

CVE Published

Feb 20, 2026 - 02:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruption. This issue has been fixed in version 9.3.0.

AnalysisAI

Calibre versions 9.2.1 and below allow authenticated users to write arbitrary files with any extension to any writable location via path traversal in PDB file readers, potentially enabling code execution or system compromise through file overwriting. The vulnerability affects both 132-byte and 202-byte PDB header variants and silently overwrites existing files without warning. Public exploit code exists and patches are available in version 9.3.0 and later.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Calibre. calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruptio

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 9.3.0.. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.