CVE-2026-33206
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Prior to version 9.6.0, calibre has a path traversal vulnerability in handling images in Markdown and similar text-based files, allowing inclusion of arbitrary files from the file system into the converted book. Missing authentication and SSRF in the background-image endpoint of the ebook reader web view allow exfiltration without additional interaction.
Risk Assessment
An attacker can read arbitrary files from the victim's file system and exfiltrate them without additional user interaction.
Recommendation
Update calibre to version 9.6.0, which contains the fix for these vulnerabilities.
Other vulnerabilities in calibre
See all- CVE-2026-73249High
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.
- CVE-2026-73248High
Calibre before version 9.12.0 processes attacker-controlled composite_template metadata from malicious EPUB, OPF, PDF, or similar files through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.
- CVE-2026-53511High
A vulnerability in calibre prior to version 9.10.0 allows arbitrary Python code execution via a malicious EPUB, OPF, or PDF file. An attacker can embed a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter.
- CVE-2026-33205Medium
calibre contains a Server-Side Request Forgery vulnerability in the background-image endpoint of its web view. An attacker can perform blind GET requests to arbitrary URLs and exfiltrate information out of the ebook sandbox. Version 9.6.0 patches the issue.
Original NVD description (English source)
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a path traversal vulnerability exists in Calibre' handling of images in Markdown and other similar text-based files allowing an attacker to include arbitrary files from the file system into the converted book. Additionally, missing authentication and server-side request forgery in the background-image endpoint in the ebook reader web view allow the files to be exfiltrated without additional interaction. Version 9.6.0 contains a fix.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS