https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:09:27 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-04347 bdu:2026-04347 https://cve.radiocsirt.org/vuln/bdu:2026-04347 https://cve.radiocsirt.org/vuln/euvd-2026-268917 EUVD-2026-268917 https://cve.radiocsirt.org/vuln/euvd-2026-268917 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26064 <p>calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith(&#39;Pictures&#39;), and does not sanitize &#39;..&#39; sequences. calibre&#39;s own ZipFile.extractall() in utils/zipfile.py does sanitize &#39;..&#39; via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.</p> <p>calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith(&#39;Pictures&#39;), and does not sanitize &#39;..&#39; sequences. calibre&#39;s own ZipFile.extractall() in utils/zipfile.py does sanitize &#39;..&#39; via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-26064 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10587-1 <p>calibre-9.7.0-1.1 on GA media</p> <p>calibre-9.7.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10587-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-26064 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: calibre, Ubuntu:18.04:LTS: calibre, Ubuntu:20.04:LTS: calibre, Ubuntu:22.04:LTS: calibre, Ubuntu:24.04:LTS: calibre, Ubuntu:25.10: calibre, Ubuntu:26.04:LTS: calibre</p> <p>calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith(&#39;Pictures&#39;), and does not sanitize &#39;..&#39; sequences. calibre&#39;s own ZipFile.extractall() in utils/zipfile.py does sanitize &#39;..&#39; via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: calibre, Ubuntu:18.04:LTS: calibre, Ubuntu:20.04:LTS: calibre, Ubuntu:22.04:LTS: calibre, Ubuntu:24.04:LTS: calibre, Ubuntu:25.10: calibre, Ubuntu:26.04:LTS: calibre</p> <p>calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith(&#39;Pictures&#39;), and does not sanitize &#39;..&#39; sequences. calibre&#39;s own ZipFile.extractall() in utils/zipfile.py does sanitize &#39;..&#39; via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-26064