CVE-2026-26065: calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruption. This issue has been fixed in version 9.3.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26065?
CVE-2026-26065 has a high severity due to its potential for arbitrary file write and code execution.
How do I fix CVE-2026-26065?
To fix CVE-2026-26065, upgrade calibre to version 9.2.2 or later.
What impact does CVE-2026-26065 have on my system?
CVE-2026-26065 can allow attackers to write arbitrary files and possibly execute code on systems running vulnerable versions of calibre.
Which versions of calibre are affected by CVE-2026-26065?
CVE-2026-26065 affects calibre versions up to and including 9.2.1.
What is a path traversal vulnerability as seen in CVE-2026-26065?
A path traversal vulnerability, like CVE-2026-26065, allows attackers to access files outside the intended directory, potentially leading to data exposure or code execution.