Path traversal in Calibre - #VU146752
Published: September 2, 2026
Vulnerability identifier: #VU146752
CSH Severity: Medium
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to write arbitrary content to arbitrary filesystem paths.
The vulnerability exists due to path traversal in the /cdb/cmd/add endpoint in src/calibre/db/cli/cmd_add.py when processing a remote book upload. A remote user can supply a crafted fname parameter containing ../ sequences to write arbitrary content to arbitrary filesystem paths.
The file write occurs before subsequent processing, so the write can complete even if the request later returns an error.
Affected software
Calibre
Remediation
Install security update from vendor's website.
Calibre - update to 9.14.0