PT-2026-25353 · Calibre · Calibre

Andrejtomci · Published 2026-01-01 · Updated 2026-04-21 · CVE-2026-30853

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions calibre versions prior to 9.5.0

Description calibre is an e-book manager used for viewing, converting, editing, and cataloging e-books. A path traversal flaw exists in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py). This allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a specially crafted .rb file. The issue stems from a failure to apply a previous fix for a similar flaw found in the PDB readers.

Recommendations Update to version 9.5.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-30853

GHSA-7MP7-RFRG-542X

OPENSUSE-SU-2026:10587-1

Affected Products

Calibre

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30853.json · Exploit
• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-7mp7-rfrg-542x · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10587-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-30853 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30853 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-30853 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-30853 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-30853 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-30853 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-30853 · Security Note
• https://suse.com/security/cve/CVE-2026-33205 · Note
• https://suse.com/security/cve/CVE-2026-27810 · Note
• https://suse.com/security/cve/CVE-2026-25731 · Note
• https://suse.com/security/cve/CVE-2026-25636 · Note
• https://suse.com/security/cve/CVE-2026-26064 · Note