Calibre CVE-2026-30853

The CVSS v3.1 score of 5.0 reflects a Medium severity rating with a local attack vector (AV:L), low attack complexity (AC:L), no privilege requirement (PR:N), and user interaction required (UI:R). The impact is limited to integrity (I:L) and availability (I:L) with changed scope (S:C), meaning files can be corrupted or deleted but not directly read. While the CVSS baseline is moderate, several factors elevate practical risk: (1) the vulnerability requires user interaction but that interaction is merely opening an e-book file, a routine and expected action; (2) the attack surface includes any source of .rb files (downloads, email attachments, shared repositories); (3) no evidence of active KEV exploitation or POC availability is present in the description, suggesting this is a pre-disclosure or early-disclosure window; (4) the fact that an identical bug class was previously fixed in CVE-2026-26065 indicates this is a known pattern of oversight in the codebase, suggesting some likelihood of attack once awareness spreads. The combination of trivial user action requirement, plausible damage vector (arbitrary file write), and demonstrated prior vulnerability patterns makes this a genuine priority despite the moderate CVSS score.

An attacker crafts a malicious RocketBook (.rb) file containing path traversal sequences in file metadata or internal path references, such as '../../../etc/cron.d/malicious_task' or '../../.calibre/plugins/malware.py'. The attacker then distributes this file via email, a file-sharing platform, or e-book repository, claiming it contains legitimate content. When a calibre user opens or attempts to convert the .rb file through the standard calibre interface, the vulnerable RB reader plugin processes the crafted paths without validation, writing the attacker's payload to arbitrary locations on disk. Depending on calibre's process permissions and the target paths, this could result in writing to startup hooks, configuration directories, or shared system locations, potentially achieving persistence or code execution on subsequent system operations.