CVE-2026-25635: 
NixOS vulnerability analysis and mitigation

CVE-2026-25635 is a path traversal vulnerability (CWE-22) in Calibre's CHM reader component that allows arbitrary file writes outside the intended extraction directory. Affecting all Calibre versions prior to 9.2.0, the flaw was disclosed on February 6, 2026, by researcher 0x5t via a GitHub Security Advisory. On Windows systems, exploitation can escalate to Remote Code Execution (RCE) by writing a malicious payload to the user's Startup folder. It carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory, Red Hat CVE).

The root cause is insufficient path sanitization in src/calibre/ebooks/chm/reader.py. At line 351, the code only strips the leading / from CHM internal file paths (path.lstrip('/')) without neutralizing .. sequences, and at lines 185–198, the unsanitized path is directly joined with the output directory via os.path.join(output_dir, fpath) before being written to disk — enabling a classic path traversal (CWE-22). An attacker crafts a CHM file containing an internal path such as /..\..\..\..\Roaming\Microsoft\Windows\STARTM~1\Programs\Startup\rce.bat; when Calibre processes this file (via GUI "Convert books" or CLI ebook-convert), the payload is written outside the extraction directory. The fix in version 9.2.0 resolves the path to an absolute path and validates it shares a common prefix with the intended output directory before writing (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to write arbitrary files to any location the current user has write access to, including sensitive system directories. On Windows, writing a malicious script or executable to the Startup folder results in RCE upon the next user login, with the payload executing at the privilege level of the logged-in user. This can lead to full compromise of confidentiality, integrity, and availability of the affected system, and may serve as a foothold for lateral movement or persistence (GitHub Advisory).

A standalone proof-of-concept (PoC) generator (create_poc.py) was published alongside the advisory, confirmed working on Calibre 9.1.0 on Windows 11 x64. Exploitation requires user interaction — the victim must open or convert a malicious CHM file — but requires no privileges. No evidence of in-the-wild exploitation has been observed as of the disclosure date, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.047% (low probability of near-term exploitation) (GitHub Advisory, Feedly).

1. Craft malicious CHM file: Use the published create_poc.py PoC script to generate a CHM file (poc.chm) containing an internal file with a path traversal sequence such as /..\..\..\..\Roaming\Microsoft\Windows\STARTM~1\Programs\Startup\rce.bat.
2. Deliver the CHM file: Distribute the malicious CHM to the target user via email, file sharing, or social engineering, disguised as a legitimate e-book or help document.
3. Trigger processing: Induce the victim to open the CHM file in Calibre (via the GUI "Convert books" function) or convert it using the CLI command ebook-convert poc.chm output.epub.
4. Path traversal executes: Calibre's CHM reader strips only the leading / from the internal path, then joins it with the output directory. The .. sequences cause os.path.join() to resolve outside the extraction directory, writing the payload (e.g., rce.bat) to the Windows Startup folder.
5. Achieve RCE: On the victim's next login, Windows automatically executes the payload from the Startup folder, running arbitrary commands (e.g., launching calc.exe in the PoC, or a reverse shell in a real attack) at the user's privilege level (GitHub Advisory).

• File System: Unexpected files (e.g., .bat, .exe, .ps1, .vbs) appearing in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\; unexpected files written to other sensitive directories (e.g., %APPDATA%, %TEMP%, user profile directories) during or after Calibre CHM processing.
• Process: Calibre process (calibre.exe, ebook-convert.exe) spawning unexpected child processes (e.g., cmd.exe, powershell.exe, calc.exe) at login time; scripts executing from the Startup folder with no corresponding legitimate software installation.
• Logs: Windows Event Logs (Event ID 4688 or Sysmon Event ID 1) showing process creation from %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ at logon; file creation events (Sysmon Event ID 11) in the Startup folder attributed to Calibre processes.
• Network: Unexpected outbound network connections originating from processes launched from the Startup folder shortly after user login (GitHub Advisory).

Upgrade Calibre to version 9.2.0 or later, which fixes the vulnerability by validating that extracted file paths share a common prefix with the intended output directory before writing (Patch Commit). Until patching is complete, users should avoid opening or converting untrusted CHM files in Calibre. As an additional defense-in-depth measure, restrict write permissions to sensitive directories such as the Windows Startup folder where possible. Debian LTS users should apply the updated package available via the Debian LTS security announcement (Debian LTS).

The vulnerability was reported by researcher 0x5t, who published a detailed write-up and PoC at 0x5t.raptx.org. The Calibre maintainer (kovidgoyal) promptly published the advisory and patch on February 6, 2026. The issue received coverage from security news outlets including The Hacker Wire and was noted in Debian and Red Hat security tracking. Debian issued a LTS security update (DLA-4554-1) in April 2026 addressing the flaw (GitHub Advisory, Debian LTS).