CVE-2026-26064Disclosure(calibre-ebook / calibre)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch calibre-ebook calibre systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith('Pictures'), and does not sanitize '..' sequences. calibre's own ZipFile.extractall() in utils/zipfile.py does sanitize '..' via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.

calibre-ebook CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/kovidgoyal/calibre/commit/e1b5f9b45a5e8fa96c136963ad9a1d35e6adac62

Exploit / PoC references

https://github.com/kovidgoyal/calibre/security/advisories/GHSA-72ch-3hqc-pgmp

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

calibre

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-02-20); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

calibre-ebook

Products

calibre

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Disclosure

250.0%

Patch

125.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-20	3	Disclosure2Patch1
2026-02-25	1	General1

Full discourse4 posts

CRAC Learning - Tech@cracbot225d
General
CVE-2026-26064 (CVSS:9.3, HIGH) is Analyzed. calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and ..https://nvd.nist.gov/vuln/detail/CVE-2026-26064 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post briefly references CVE-2026-26064 with its CVSS score and a link to the NVD entry, but provides no further details or actionable information.
0000037
172 followersView on X
The Hacker Wire@TheHackerWire229d
Disclosure
🟠 CVE-2026-26064 - High calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file... https://www.thehackerwire.com/vulnerability/CVE-2026-26064/ https://t.co/FT22lQlv3I
Post summary
The snippet announces the discovery of CVE-2026-26064, a high‑severity Path Traversal vulnerability in calibre, but does not provide PoC, exploit code, or patch details.
0000035
112 followersView on X
CVE@CVEnew230d
Disclosure
CVE-2026-26064 calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability t… https://www.cve.org/CVERecord?id=CVE-2026-26064
Post summary
The passage describes a path‑traversal vulnerability in Calibre 9.2.1 and earlier, providing technical details but no PoC, exploit, or patch information.
0000071
56.4K followersView on X
OffSeq | Adversary Tactics for Cyber Resilience@offseq230d
Patch
🚨 A CRITICAL path traversal flaw in calibre <9.3.0 lets attackers write files anywhere — even remote code execution on Windows! Upgrade NOW to stay safe. https://radar.offseq.com/threat/cve-2026-26064-cwe-22-improper-limitation-of-a-pat-71d04e0e #OffSeq #Calibre #CyberSecurity https://t.co/OSKONxY8hu
Post summary
The tweet highlights a critical path‑traversal flaw in Calibre that could lead to remote code execution on Windows and urges immediate upgrade to mitigate the risk.
0000041
265 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	calibre-ebook	calibre	-	-	-

Explore more

Back to dashboard calibre-ebook CVEs calibre vulnerabilities

What researchers are saying

CVE-2026-26064

OffSeq | Adversary Tactics for Cyber Resilience[verified]@offseqPatch

The tweet highlights a critical path‑traversal flaw in Calibre that could lead to remote code execution on Windows and urges immediate upgrade to mitigate the risk.

CRAC Learning - Tech@cracbotGeneral

The post briefly references CVE-2026-26064 with its CVSS score and a link to the NVD entry, but provides no further details or actionable information.

The Hacker Wire@TheHackerWireDisclosure

The snippet announces the discovery of CVE-2026-26064, a high‑severity Path Traversal vulnerability in calibre, but does not provide PoC, exploit code, or patch details.

CVE@CVEnewDisclosure

The passage describes a path‑traversal vulnerability in Calibre 9.2.1 and earlier, providing technical details but no PoC, exploit, or patch information.