High severity8.2NVD Advisory· Published Feb 6, 2026· Updated Jun 17, 2026
CVE-2026-25636
CVE-2026-25636
Description
calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem path and opens it in read-write mode, even when it points outside the conversion extraction directory. This vulnerability is fixed in 9.2.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:calibre-ebook:calibre:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:calibre-ebook:calibre:*:*:*:*:*:*:*:*range: <9.2.0
- (no CPE)range: < 9.2.0
Patches
Vulnerability mechanics
References
3- github.com/kovidgoyal/calibre/commit/9484ea82c6ab226c18e6ca5aa000fa16de598726nvdPatch
- 0x5t.raptx.org/posts/calibre-epub-rcenvdExploitThird Party Advisory
- github.com/kovidgoyal/calibre/security/advisories/GHSA-8r26-m7j5-hm29nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.