What is the CVSS score of CVE-2026-30853?

CVE-2026-30853 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Calibre are affected by CVE-2026-30853?

Organizations using calibre should be aware of moderate risk from CVE-2026-30853, a path traversal vulnerability rated CVSS 5.0. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2026-30853?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Calibre CVE-2026-30853

EUVD-2026-12069 MEDIUM

Path Traversal (CWE-22)

2026-03-13 GitHub_M

Path Traversal Red Hat Calibre Suse Kovidgoyal

5.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.0 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

SUSE

8.2 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Red Hat

5.0 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

9.5.0

EUVD ID Assigned

Mar 13, 2026 - 20:00 euvd

EUVD-2026-12069

Analysis Generated

Mar 13, 2026 - 20:00 vuln.today

CVE Published

Mar 13, 2026 - 19:00 nvd

MEDIUM 5.0

DescriptionGitHub Advisory

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py) allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a crafted .rb file. This is the same bug class fixed in CVE-2026-26065 for the PDB readers, but the fix was never applied to the RB reader. This vulnerability is fixed in 9.5.0.

AnalysisAI

Arbitrary file write vulnerability in Calibre's RocketBook input plugin enables attackers to write files to any location accessible by the Calibre process when a user opens or converts a malicious .rb file. The path traversal flaw affects versions prior to 9.5.0 and represents an unpatched instance of the same vulnerability class previously fixed in the PDB reader component. Local attackers can leverage this to corrupt files, modify configuration, or potentially achieve code execution depending on file system permissions.

Technical ContextAI

The vulnerability resides in the RocketBook (.rb) input plugin located at src/calibre/ebooks/rb/reader.py within the calibre e-book management suite. The root cause is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'), a classic file system traversal flaw where insufficient input validation on file paths allows an attacker to escape intended directory boundaries. The calibre application is identified by CPE 2.3:a:calibre:calibre. When processing .rb files, the plugin fails to properly validate or sanitize path components, potentially allowing directory traversal sequences (such as '../') embedded within crafted file entries to resolve to arbitrary filesystem locations. This is particularly dangerous because e-book conversion plugins run with the privileges of the calibre process, which typically has broad file system write access on user systems.

RemediationAI

Users should immediately upgrade calibre to version 9.5.0 or later, which includes the fix for the path traversal vulnerability in the RocketBook plugin. Until patching is completed, users should avoid opening or converting .rb files from untrusted sources (downloads from unfamiliar websites, unsolicited email attachments, or unverified repositories). System administrators managing calibre deployments can additionally restrict the file system permissions granted to the calibre process to limit the scope of potential damage from exploitation, though this is a compensating control rather than a primary fix. For organizations unable to upgrade immediately, consider disabling the RB input plugin entirely if .rb file support is not essential to business operations.