CVE-2026-25636Disclosure(calibre-ebook / calibre)

LOWCVSS 7.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch calibre-ebook calibre systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem path and opens it in read-write mode, even when it points outside the conversion extraction directory. This vulnerability is fixed in 9.2.0.

calibre-ebook CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/kovidgoyal/calibre/commit/9484ea82c6ab226c18e6ca5aa000fa16de598726

Exploit / PoC references

Weakness type (CWE)

CWE-22CWE-73CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

calibre

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-02-06); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

calibre-ebook

Products

calibre

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

250.0%

Patch

250.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-06	2	Disclosure2
2026-02-08	2	Patch2

Full discourse4 posts

PulsePatch.io@pulsepatchio242d
Patch
Calibre users: A path traversal flaw (CVE-2026-25636) can lead to arbitrary file corruption and code execution. Update installations. #Calibre #InfoSec #Vulnerability https://www.pulsepatch.io/posts/cve-2026-25636-calibre-path-traversal-rce
Post summary
The post highlights a path traversal vulnerability in Calibre (CVE-2026-25636) capable of arbitrary file corruption and code execution, and urges users to apply updates to remediate the risk.
0000052
1 followersView on X
PulsePatch.io@pulsepatchio242d
Patch
Calibre versions 9.1.0 and earlier are affected by a path traversal vulnerability (CVE-2026-25636). Malicious EPUB files can corrupt writable files. Update to 9.2.0. #Calibre #Security #Pathtraversal https://www.pulsepatch.io/posts/calibre-path-traversal-cve-2026-25636
Post summary
Calibre 9.1.0 and earlier are vulnerable to a path traversal flaw via malicious EPUB files; the issue is fixed in 9.2.0 and users should update promptly.
0000040
1 followersView on X
The Hacker Wire@TheHackerWire244d
Disclosure
🟠 CVE-2026-25636 - High calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by th... https://www.thehackerwire.com/vulnerability/CVE-2026-25636/ https://t.co/h2xKOUG1u3
Post summary
The post announces a high‑severity path‑traversal vulnerability in Calibre’s EPUB conversion that can corrupt arbitrary writable files, without detailing PoC, exploitation, or patches.
0000052
113 followersView on X
CVE@CVEnew244d
Disclosure
CVE-2026-25636 calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary exis… https://www.cve.org/CVERecord?id=CVE-2026-25636
Post summary
The text describes a path‑traversal flaw in Calibre 9.1.0 and earlier that lets a crafted EPUB corrupt files, but it offers no PoC, exploit code, or evidence of active exploitation, and no patch is mentioned.
00000173
56.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	calibre-ebook	calibre	-	-	-

Explore more

Back to dashboard calibre-ebook CVEs calibre vulnerabilities

What researchers are saying

CVE-2026-25636

PulsePatch.io@pulsepatchioPatch

The post highlights a path traversal vulnerability in Calibre (CVE-2026-25636) capable of arbitrary file corruption and code execution, and urges users to apply updates to remediate the risk.

PulsePatch.io@pulsepatchioPatch

Calibre 9.1.0 and earlier are vulnerable to a path traversal flaw via malicious EPUB files; the issue is fixed in 9.2.0 and users should update promptly.

The Hacker Wire@TheHackerWireDisclosure

The post announces a high‑severity path‑traversal vulnerability in Calibre’s EPUB conversion that can corrupt arbitrary writable files, without detailing PoC, exploitation, or patches.

CVE@CVEnewDisclosure

The text describes a path‑traversal flaw in Calibre 9.1.0 and earlier that lets a crafted EPUB corrupt files, but it offers no PoC, exploit code, or evidence of active exploitation, and no patch is mentioned.