High severity · published Feb 20, 2026
CVE-2026-26065
calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruption. This issue has been fixed in version 9.3.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
calibre · kovidgoyal
< 9.3.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26065
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26065
Patch
https://github.com/kovidgoyal/calibre/commit/b6da1c3878c06eb1356cb0ec1106cb66e0e9bfb8
Exploit
https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vmfh-7mr7-pp2w
More from calibre
9.3
CVE-2025-64486
calibre is vulnerable to arbitrary code execution when opening FB2 files
8.8
CVE-2026-26064
calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution
8.6
CVE-2026-25635
calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution
8.5
CVE-2026-73248
calibre: Bypass of Python template restrictions via nested `template()` leading to RCE
8.5
CVE-2026-53511
calibre: Arbitrary Code Execution in Template Formatter via Book Metadata