CVE-2026-26064CWE-22

calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution

Critical · published February 20, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
60.9
In the wild
Unconfirmed
What it is

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith('Pictures'), and does not sanitize '..' sequences. calibre's own ZipFile.extractall() in utils/zipfile.py does sanitize '..' via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00950 · 60.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-02-20T01:44Z
EPSS history
Timeline
  • 20 FEB 01:44Z
    calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution
    cvelistv5