CVE-2026-25636
📋 TL;DR
A path traversal vulnerability in Calibre's EPUB conversion allows malicious EPUB files to corrupt arbitrary files writable by the Calibre process. Attackers can exploit this by crafting EPUB files with specially crafted CipherReference URIs that point outside the extraction directory. Users of Calibre 9.1.0 and earlier who convert untrusted EPUB files are affected.
💻 Affected Systems
- Calibre
📦 What is this software?
Calibre by Calibre Ebook
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through corruption of critical system files, privilege escalation, or data destruction if Calibre runs with elevated privileges.
Likely Case
Data corruption of user files, potential loss of e-book libraries, or denial of service through file corruption.
If Mitigated
Limited to corruption of files within the user's home directory if Calibre runs with minimal privileges.
🎯 Exploit Status
Exploitation requires the victim to open a malicious EPUB file in Calibre. The vulnerability is straightforward to exploit once the attack vector is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.2.0
Vendor Advisory: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-8r26-m7j5-hm29
Restart Required: Yes
Instructions:
1. Download Calibre 9.2.0 or later from https://calibre-ebook.com/download. 2. Install the new version over your existing installation. 3. Restart Calibre to ensure the fix is active.
🔧 Temporary Workarounds
Disable EPUB conversion
allTemporarily disable EPUB conversion functionality to prevent exploitation
Not applicable - disable through Calibre GUI preferences
Run Calibre with restricted permissions
linuxRun Calibre with minimal file system access using sandboxing or containerization
firejail calibre
bwrap --dev-bind / / --bind $HOME $HOME calibre
🧯 If You Can't Patch
- Avoid converting untrusted EPUB files - only process EPUBs from trusted sources
- Run Calibre in a sandboxed environment with restricted file system access
🔍 How to Verify
Check if Vulnerable:
Check Calibre version: if version is 9.1.0 or earlier, the system is vulnerable.Check Version:
calibre --versionVerify Fix Applied:
Verify Calibre version is 9.2.0 or later and test EPUB conversion with a known safe file.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns during EPUB conversion
- Errors related to file corruption or permission denied for unexpected paths
Network Indicators:
- Downloads of EPUB files from untrusted sources followed by conversion activity
SIEM Query:
process_name:"calibre" AND (event_type:"file_access" AND file_path NOT CONTAINS "/tmp/" AND file_path NOT CONTAINS user_home_directory)