CVE-2026-25731
📋 TL;DR
A Server-Side Template Injection vulnerability in Calibre's Templite engine allows arbitrary code execution when converting ebooks using malicious custom templates via command-line options. This affects users of Calibre versions prior to 9.2.0 who convert ebooks with custom templates. Attackers could execute arbitrary code on the victim's system.
💻 Affected Systems
- Calibre
📦 What is this software?
Calibre by Calibre Ebook
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the victim's machine, allowing data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive files, user data, and system resources on the affected machine.
If Mitigated
Limited impact if users don't use custom templates or have restricted command-line access, though the vulnerability remains present in the software.
🎯 Exploit Status
Exploitation requires user interaction (converting ebook with malicious template) and knowledge of SSTI techniques. No public exploit code identified yet.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.2.0
Vendor Advisory: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-xrh9-w7qx-3gcc
Restart Required: No
Instructions:
1. Download Calibre 9.2.0 or later from https://calibre-ebook.com/download. 2. Install the new version, overwriting the previous installation. 3. Verify the version with 'calibre --version' command.
🔧 Temporary Workarounds
Disable custom template usage
allPrevent users from using custom templates via command-line options
Remove execute permissions from calibre binary for non-admin users
Implement policy restricting use of --template-html and --template-html-index options
Sandbox execution
linuxRun Calibre in restricted environment to limit potential damage
Use containerization (Docker) with limited privileges
Implement AppArmor/SELinux profiles for Calibre
🧯 If You Can't Patch
- Restrict user access to Calibre command-line tools to trusted administrators only
- Monitor for unusual process creation or network connections from Calibre processes
🔍 How to Verify
Check if Vulnerable:
Run 'calibre --version' and check if version is below 9.2.0Check Version:
calibre --versionVerify Fix Applied:
Run 'calibre --version' and confirm version is 9.2.0 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Calibre
- Command-line arguments containing --template-html or --template-html-index with suspicious template paths
Network Indicators:
- Unexpected outbound connections from Calibre processes
SIEM Query:
Process creation where parent process contains 'calibre' and command line contains '--template-html' or '--template-html-index'