CVE-2026-25636 calibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution

High 8.2 Published 6 Feb 2026 Updated 11 Feb 2026

A malicious EPUB file can trigger path traversal in Calibre, allowing arbitrary file corruption and potential code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-25636?

CVE-2026-25636 is a high-severity path traversal vulnerability in kovidgoyal calibre, published on 6 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem path and opens it in read-write mode, even when it points outside the conversion extraction directory. This vulnerability is fixed in 9.2.0.

Weakness: CWE-94, CWE-73, CWE-22

Which versions are affected by CVE-2026-25636?

It affects 1 product.

Products include Calibre-Ebook Calibre.

How do I fix CVE-2026-25636?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-25636 being exploited?

There is no known exploitation of CVE-2026-25636 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-25636, GHSA-8r26-m7j5-hm29, UBUNTU-CVE-2026-25636.