CVE-2026-26065

Katalog CVE

CVSS 8.8 · High EPSS 0,57%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada calibre-ebook calibre. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruption. This issue has been fixed in version 9.3.0.

Rincian

Terbit di NVD

20 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kovidgoyal/calibre/commit/b6da1c3878c06eb1356cb0ec1106cb66e0e9bfb8 patch
• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vmfh-7mr7-pp2w exploit · advisory pihak ketiga