PT-2026-20989 · Calibre · Calibre

0X5T · Published 2026-02-20 · Updated 2026-04-21 · CVE-2026-26065

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions calibre versions 9.2.1 and below

Description calibre is a cross-platform e-book manager used for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are susceptible to a Path Traversal issue through PDB readers, specifically both 132-byte and 202-byte header variants. This allows for arbitrary file writes with arbitrary extensions and content in locations where the user has write permissions. Files are written in 'wb' mode, which silently overwrites existing files. This can potentially lead to code execution and Denial of Service through file corruption.

Recommendations Update to version 9.3.0 or later.

Exploit

Fix

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-04348

CVE-2026-26065

GHSA-VMFH-7MR7-PP2W

OPENSUSE-SU-2026:10587-1

Affected Products

Calibre

References · 31

• 🔥 https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vmfh-7mr7-pp2w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26065.json · Exploit
• https://github.com/kovidgoyal/calibre/commit/b6da1c3878c06eb1356cb0ec1106cb66e0e9bfb8 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-26065 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26065 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26065 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-26065 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26065 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04348 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10587-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26065 · Security Note
• https://ubuntu.com/security/CVE-2026-26065 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-25635 · Note
• https://twitter.com/offseq/status/2024680460501053821 · Twitter Post
• https://suse.com/security/cve/CVE-2026-26064 · Note