CVE-2026-25635: Path Traversal in Calibre e-book Manager

The primary impact of this vulnerability is the potential for Remote Code Execution on Windows systems. An attacker could craft a malicious file and leverage the path traversal flaw to write it to the user's Startup folder. Upon the next system login, this file would automatically execute, granting the attacker control over the affected machine. The blast radius extends to any user with write access to the vulnerable Calibre installation. While testing was limited to Windows, the potential for file writes exists on other operating systems, though RCE may not be directly achievable without further exploitation.

1. Reserved2026-02-04
2. Published2026-02-06
3. Modified2026-02-11
4. EPSS updated2026-03-23

The recommended mitigation is to immediately upgrade Calibre to version 9.2.0 or later, which addresses this vulnerability. If upgrading is not immediately feasible, consider restricting write access to the Calibre installation directory to prevent unauthorized file modifications. While a direct WAF rule is unlikely to be effective, monitoring file system activity for unexpected file creations within the Calibre directory, particularly in the Startup folder on Windows, can provide an early warning. There are no specific Sigma or YARA patterns available at this time.