calibre hat eine Path Traversal Leading zu Arbiträrem Dateischreiben und Potentiellem Code Execution

The primary impact of this vulnerability is the potential for Remote Code Execution on Windows systems. An attacker could craft a malicious CHM file that, when opened in Calibre, allows them to write arbitrary files to any location the user has write access to. The most concerning scenario involves writing a malicious executable to the user's Startup folder. Upon the next system login, this executable would automatically run with the user's privileges, granting the attacker control over the system. While the description notes testing was limited to Windows, the path traversal nature of the vulnerability suggests similar exploitation paths might exist on other operating systems, though the RCE vector may differ. This vulnerability shares characteristics with other path traversal exploits, where attackers leverage improper input validation to access and modify files outside of the intended directory.

Users of Calibre e-book manager, particularly those on Windows systems, are at risk. Shared hosting environments where Calibre is installed and accessible to multiple users are especially vulnerable, as an attacker could potentially compromise the entire host.

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.Action.Path -like "*Calibre*"}

• windows / supply-chain:

Get-ChildItem -Path "$env:AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" -Filter "*Calibre*.*"

• other: Monitor Calibre installation directory for unexpected file creations, especially executable files.

1. 2026-02-06Disclosure

   disclosure

1. Reserviert2026-02-04
2. Veröffentlicht2026-02-06
3. Geändert2026-02-11
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade Calibre to version 9.2.0 or later, which contains the fix for this vulnerability. If an immediate upgrade is not feasible, consider restricting user write access to sensitive directories, particularly the Startup folder on Windows. While a direct WAF rule is unlikely to be effective against this type of vulnerability, implementing strict input validation on any file uploads or processing within Calibre could provide an additional layer of defense. There are no specific Sigma or YARA rules readily available for this particular vulnerability, but monitoring for unusual file creation activity in user directories, especially executable files in the Startup folder, is recommended. After upgrading, confirm the fix by attempting to create a file outside the intended directory using a crafted CHM file and verifying that the operation is denied.