Read the docs
TI-2026-23682 Aliases CVE-2026-30853

calibre has a Path Traversal Leading to Arbitrary File Write

Priority HIGH 69CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py) allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a crafted .rb file. This is the same bug class fixed in CVE-2026-26065 for the PDB readers, but the fix was never applied to the RB reader. This vulnerability is fixed in 9.5.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0019 8th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed calibre (kovidgoyal): 9.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kovidgoyalcalibrebefore 9.5.09.5.0Patch availableCNA
  • calibre Vendorkovidgoyal Affected before 9.5.0 Fixed in 9.5.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:calibre-ebook:calibre:*:*:*:*:*:*:*:*before 9.5.0VulnerableCalibre
  • cpe:2.3:a:calibre-ebook:calibre:*:*:*:*:*:*:*:* Versions before 9.5.0 Vulnerable ·Calibre

Remediation

  • Fix · CNA calibre (kovidgoyal) Fixed in 9.5.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30853

References

Exploit 1

  • TI-2026-26023 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check CVSS 3.1CRITICAL 9.9
  • TI-2026-51129 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences CVSS 4.0HIGH 7.3
  • TI-2026-26014 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler CVSS 3.1HIGH 8.8
  • TI-2026-51386 Missing authorization in kovidgoyal calibre CVSS 3.1HIGH 7.5
  • TI-2026-51385 calibre: Bypass of Python template restrictions via nested `template()` leading to RCE CVSS 4.0HIGH 8.5
  • TI-2026-38585 calibre: Arbitrary Code Execution in Template Formatter via Book Metadata CVSS 4.0HIGH 8.5
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences