CVE-2026-25636: Path Traversal in Calibre e-book Manager

An attacker could exploit this vulnerability by crafting a malicious EPUB file. When Calibre attempts to convert this file, the vulnerability allows the attacker to specify an arbitrary file path outside of the intended conversion directory. Calibre then opens this file in read-write mode, enabling the attacker to overwrite or delete existing files. The potential impact ranges from data corruption within the Calibre library to broader system compromise if Calibre runs with elevated privileges. This is particularly concerning for users who manage sensitive e-books or use Calibre on shared systems.

1. Reserved2026-02-04
2. Published2026-02-06
3. Modified2026-02-11
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-25636 is to upgrade Calibre to version 9.2.0 or later, which contains the fix. If upgrading is not immediately feasible, consider restricting the types of EPUB files accepted from untrusted sources. Implement a strict file extension whitelist to prevent the processing of potentially malicious files. Monitor Calibre's file system access logs for unusual activity, particularly writes to unexpected locations. After upgrading, confirm the fix by attempting to convert a test EPUB file with a deliberately malformed CipherReference URI; the conversion should fail with an appropriate error message.