CVE-2026-26064 calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution

Critical 9.3 Published 20 Feb 2026 Updated 20 Feb 2026

Attackers can exploit path traversal in calibre to write arbitrary files, enabling remote code execution on Windows via startup folder injection.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-26064?

CVE-2026-26064 is a critical path traversal vulnerability in kovidgoyal calibre, published on 20 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith('Pictures'), and does not sanitize '..' sequences. calibre's own ZipFile.extractall() in utils/zipfile.py does sanitize '..' via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.

Weakness: CWE-22

Which versions are affected by CVE-2026-26064?

It affects 1 product.

Products include Calibre-Ebook Calibre.

How do I fix CVE-2026-26064?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-26064 being exploited?

There is no known exploitation of CVE-2026-26064 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-26064, GHSA-72ch-3hqc-pgmp, UBUNTU-CVE-2026-26064.