CVE-2026-25635
📋 TL;DR
Calibre e-book manager versions before 9.2.0 contain a path traversal vulnerability in the CHM reader that allows attackers to write arbitrary files anywhere the user has write permissions. On Windows systems, this can lead to remote code execution by placing malicious files in the Startup folder, which execute automatically on user login. All users running vulnerable versions of Calibre are affected.
💻 Affected Systems
- calibre
📦 What is this software?
Calibre by Calibre Ebook
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with full user privileges, potentially leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Local file system corruption, data loss, or malware installation through crafted CHM files.
If Mitigated
Limited to file writes in user-writable directories without execution privileges.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious CHM file. The vulnerability is straightforward to exploit once a malicious file is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.2.0
Vendor Advisory: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-32vh-whvh-9fxr
Restart Required: No
Instructions:
1. Open Calibre. 2. Go to Help → Check for updates. 3. Follow prompts to update to version 9.2.0 or later. 4. Alternatively, download and install the latest version from calibre-ebook.com.
🔧 Temporary Workarounds
Disable CHM file processing
allPrevent Calibre from opening CHM files by removing or disabling the CHM reader plugin.
Remove the CHM input plugin from Calibre's plugin directory
Restrict file system access
allRun Calibre with reduced privileges or in a sandboxed environment.
🧯 If You Can't Patch
- Avoid opening CHM files from untrusted sources with Calibre.
- Use alternative software for CHM file viewing until patched.
🔍 How to Verify
Check if Vulnerable:
Check Calibre version in Help → About. If version is below 9.2.0, the system is vulnerable.Check Version:
calibre --versionVerify Fix Applied:
Confirm Calibre version is 9.2.0 or higher in Help → About.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations by Calibre process
- CHM file processing errors
Network Indicators:
- Downloads of CHM files from untrusted sources
SIEM Query:
Process:calibre AND (FileWrite:*\Startup\* OR FileWrite:*\..\*)