CVE-2026-26065 calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution

Critical 9.3 Published 20 Feb 2026 Updated 20 Feb 2026

Path traversal in calibre's PDB readers allows arbitrary file writes, potentially leading to code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-26065?

CVE-2026-26065 is a critical path traversal vulnerability in kovidgoyal calibre, published on 20 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruption. This issue has been fixed in version 9.3.0.

Weakness: CWE-22

Which versions are affected by CVE-2026-26065?

It affects 1 product.

Products include Calibre-Ebook Calibre.

How do I fix CVE-2026-26065?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-26065 being exploited?

There is no known exploitation of CVE-2026-26065 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-26065, GHSA-vmfh-7mr7-pp2w, UBUNTU-CVE-2026-26065.