CVE-2026-26065

Name	CVE-2026-26065
Description	calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruption. This issue has been fixed in version 9.3.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
calibre (PTS)	bullseye	5.12.0+dfsg-1+deb11u2	vulnerable
	bullseye (security)	5.12.0+dfsg-1+deb11u3	vulnerable
	bookworm	6.13.0+repack-2+deb12u5	vulnerable
	trixie	8.5.0+ds-1+deb13u1	vulnerable
	forky	8.16.2+ds+~0.10.5-3	vulnerable
	sid	9.3.0+ds+~0.10.5-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
calibre	source	(unstable)	9.3.0+ds+~0.10.5-1

Notes

https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vmfh-7mr7-pp2w
Fixed by: https://github.com/kovidgoyal/calibre/commit/b6da1c3878c06eb1356cb0ec1106cb66e0e9bfb8 (v9.3.0)