PT-2026-25353 · Calibre · Calibre

Andrejtomci · Publicado 2026-01-01 · Atualizado 2026-04-21 · CVE-2026-30853

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions calibre versions prior to 9.5.0

Description calibre is an e-book manager used for viewing, converting, editing, and cataloging e-books. A path traversal flaw exists in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py). This allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a specially crafted .rb file. The issue stems from a failure to apply a previous fix for a similar flaw found in the PDB readers.

Recommendations Update to version 9.5.0 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-30853

GHSA-7MP7-RFRG-542X

OPENSUSE-SU-2026:10587-1

Produtos afetados

Calibre

Referências · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30853.json · Exploit
• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-7mp7-rfrg-542x · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2026:10587-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-33205 · Nota
• https://suse.com/security/cve/CVE-2026-27810 · Nota
• https://security-tracker.debian.org/tracker/CVE-2026-30853 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-30853 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-25731 · Nota
• https://suse.com/security/cve/CVE-2026-25636 · Nota
• https://suse.com/security/cve/CVE-2026-26064 · Nota
• https://suse.com/security/cve/CVE-2026-30853 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-30853 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-26065 · Nota
• https://suse.com/security/cve/CVE-2026-33206 · Nota
• https://ubuntu.com/security/CVE-2026-30853 · Aviso do Fabricante