CVE-2026-30853 calibre has a Path Traversal Leading to Arbitrary File Write

What is CVE-2026-30853?

CVE-2026-30853 is a medium-severity path traversal vulnerability in kovidgoyal calibre, published on 13 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py) allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a crafted .rb file. This is the same bug class fixed in CVE-2026-26065 for the PDB readers, but the fix was never applied to the RB reader. This vulnerability is fixed in 9.5.0.

Weakness: CWE-22

Which versions are affected by CVE-2026-30853?

It affects 1 product.

Products include Calibre-Ebook Calibre.

How do I fix CVE-2026-30853?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-30853 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30853 exists.

Other vulnerabilities in kovidgoyal calibre

• CVE-2011-4124 Command injection in Calibre Critical 9.8
• CVE-2011-4125 Privilege escalation in Calibre Critical 9.8
• CVE-2026-26064 calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution Critical 9.3
• CVE-2026-26065 calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution Critical 9.3
• CVE-2026-25635 calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-30853, GHSA-7mp7-rfrg-542x, UBUNTU-CVE-2026-30853.