PT-2026-20988 · Calibre · Calibre

0X5T · Published 2026-02-20 · Updated 2026-04-21 · CVE-2026-26064

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions calibre versions 9.2.1 and below

Description calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. A Path Traversal flaw exists in versions 9.2.1 and below, allowing arbitrary file writes where the user has write permissions. On Windows systems, this can lead to Remote Code Execution by writing a malicious payload to the Startup folder, which is then executed upon the next user login. The extract pictures function only verifies that file names start with 'Pictures' and does not properly sanitize '..' sequences. While calibre's ZipFile.extractall() function in utils/zipfile.py sanitizes '..' using get targetpath(), the extract pictures() function bypasses this protection by using manual zf.read() and open() operations.

Recommendations Update to calibre version 9.3.0 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-04347

CVE-2026-26064

GHSA-72CH-3HQC-PGMP

OPENSUSE-SU-2026:10587-1

Affected Products

Calibre

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26064.json · Exploit
• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-72ch-3hqc-pgmp · Vendor Advisory
• https://github.com/kovidgoyal/calibre/commit/e1b5f9b45a5e8fa96c136963ad9a1d35e6adac62 · Patch
• https://ubuntu.com/security/CVE-2026-26064 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04347 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26064 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-26064 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26064 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26064 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26064 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-26064 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10587-1 · Vendor Advisory
• https://t.me/cveNotify/152556 · Telegram Post
• https://suse.com/security/cve/CVE-2026-25635 · Note
• https://twitter.com/TheHackerWire/status/2024912115388350585 · Twitter Post