https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T07:43:35.823747+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-25636 CVE-2026-25636 — calibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution 2026-09-28T07:43:35.833209+00:00

Affected: kovidgoyal calibre

calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem path and opens it in read-write mode, even when it points outside the conversion extraction directory. This vulnerability is fixed in 9.2.0.