https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:00:30 +0000 https://vulnerability.circl.lu/vuln/cve-2026-26064 <p><strong>Affected:</strong> kovidgoyal calibre</p> <p>calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith(&#39;Pictures&#39;), and does not sanitize &#39;..&#39; sequences. calibre&#39;s own ZipFile.extractall() in utils/zipfile.py does sanitize &#39;..&#39; via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.</p> <p><strong>Affected:</strong> kovidgoyal calibre</p> <p>calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith(&#39;Pictures&#39;), and does not sanitize &#39;..&#39; sequences. calibre&#39;s own ZipFile.extractall() in utils/zipfile.py does sanitize &#39;..&#39; via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-26064