SB2026090257 - Multiple vulnerabilities in Calibre

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090257

SB2026090257 - Multiple vulnerabilities in Calibre

Published: September 2, 2026

Security Bulletin ID SB2026090257
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 80% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) External Control of File Name or Path (CVE-ID: N/A)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write arbitrary files.

The vulnerability exists due to improper neutralization of special elements in the fb2 import XSLT stylesheet when parsing a crafted .fb2 book. A remote attacker can supply a malicious book with an injected namespace to write arbitrary files.

The payload runs automatically during page counting after the book is added, and no manual conversion or special configuration is required.


2) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write arbitrary content to arbitrary filesystem paths.

The vulnerability exists due to path traversal in the /cdb/cmd/add endpoint in src/calibre/db/cli/cmd_add.py when processing a remote book upload. A remote user can supply a crafted fname parameter containing ../ sequences to write arbitrary content to arbitrary filesystem paths.

The file write occurs before subsequent processing, so the write can complete even if the request later returns an error.


3) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to overwrite arbitrary files on the server filesystem.

The vulnerability exists due to path traversal in the Content Server /conversion/start endpoint when processing a crafted output_fmt parameter. A remote user can send a specially crafted conversion request to overwrite arbitrary files on the server filesystem.

Trusted IP access may also be sufficient without authentication in some configurations, and the target library must contain at least one book with a convertible format.


4) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper control of code generation in the Content Server upload endpoints and recipe conversion pipeline when uploading a crafted downloaded_recipe file and triggering conversion. A remote user can upload a malicious .downloaded_recipe archive and start a conversion job to execute arbitrary code.

Write access to the Content Server is required, and code runs with the privileges of the calibre server process.


5) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in the victim's browser.

The vulnerability exists due to cross-site scripting in the legacy content server book details page when rendering crafted identifier metadata through the /legacy/book/{book_id}/{library_id} endpoint. A remote user can upload or add a malicious EPUB with a crafted dc:identifier value to execute arbitrary JavaScript in the victim's browser.

User interaction is required to view the affected legacy book details page, and the legacy endpoint remains reachable through older clients and direct URLs.


Remediation

Install update from vendor's website.

References