PT-2026-20989 · Calibre · Calibre

0X5T · Publicado 2026-02-20 · Atualizado 2026-04-21 · CVE-2026-26065

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions calibre versions 9.2.1 and below

Description calibre is a cross-platform e-book manager used for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are susceptible to a Path Traversal issue through PDB readers, specifically both 132-byte and 202-byte header variants. This allows for arbitrary file writes with arbitrary extensions and content in locations where the user has write permissions. Files are written in 'wb' mode, which silently overwrites existing files. This can potentially lead to code execution and Denial of Service through file corruption.

Recommendations Update to version 9.3.0 or later.

Exploit

Correção

DoS

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2026-04348

CVE-2026-26065

GHSA-VMFH-7MR7-PP2W

OPENSUSE-SU-2026:10587-1

Produtos afetados

Calibre

Referências · 31

• 🔥 https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vmfh-7mr7-pp2w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26065.json · Exploit
• https://github.com/kovidgoyal/calibre/commit/b6da1c3878c06eb1356cb0ec1106cb66e0e9bfb8 · Correção
• https://suse.com/security/cve/CVE-2026-25635 · Nota
• https://security-tracker.debian.org/tracker/CVE-2026-26065 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-26065 · Aviso do Fabricante
• https://twitter.com/offseq/status/2024680460501053821 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-26064 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-26065 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-26065 · Aviso do Fabricante
• https://twitter.com/pulsepatchio/status/2026311189928493422 · Publicação no Twitter
• https://t.me/poxek/5938 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26065 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2024704440733671859 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-27810 · Nota