CVE-2026-26065
High
Description
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruption. This issue has been fixed in version 9.3.0.
SeverityHigh
CVSS8.8
Exploit probability—
ProductCalibre
PublishedFeb 20, 2026
First seenFeb 20, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- calibre-ebook calibre9.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| calibre-ebook calibre | v < 9.3.0 | 9.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.