CVE-2026-25636: 
NixOS vulnerability analysis and mitigation

CVE-2026-25636 is a path traversal vulnerability in Calibre's EPUB conversion functionality that allows a malicious EPUB file to corrupt arbitrary files writable by the Calibre process, and can be escalated to code execution. It affects Calibre versions 9.1.0 and earlier, and was disclosed on February 6, 2026. The vulnerability was fixed in Calibre 9.2.0. It carries a CVSS v3.1 base score of 7.8 (High) per NVD, or 8.2 (High) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is improper sanitization of the URI attribute extracted from META-INF/encryption.xml within an EPUB file (CWE-22, CWE-73, CWE-94). In src/calibre/ebooks/conversion/plugins/epub_input.py, the process_encryption() function resolves the CipherReference URI using os.path.abspath(os.path.join(..., *uri.split('/'))), which preserves ../ path components and allows traversal outside the EPUB extraction directory. The resolved path is then opened in read-write mode by decrypt_font(), which XORs the first ~1KB of the target file with the book's UUID-derived SHA-1 key. Exploitation requires user interaction — the victim must attempt to convert the malicious EPUB via the GUI ("Convert books") or the ebook-convert CLI. The fix in 9.2.0 introduces a container_base boundary check using is_existing_subpath() to ensure the resolved path stays within the EPUB container directory (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to corrupt any file writable by the Calibre process — including shell profiles (~/.profile, ~/.bash_profile), application configuration files, SSH client state, and local databases — by XOR-overwriting the first ~1KB with a UUID-derived key. Beyond data loss and denial of service, the vulnerability can be escalated to code execution: by brute-forcing a UUID whose SHA-1 hash produces a desired XOR output, an attacker can craft a payload that transforms a known file (e.g., ~/.profile) into one that executes arbitrary shell commands upon next login. The attack is local in vector but can be delivered remotely via a socially engineered EPUB file, and the scope of file corruption is bounded only by the permissions of the Calibre process user (GitHub Advisory).

A public proof-of-concept EPUB structure is documented in the GitHub Security Advisory, demonstrating file corruption on both Linux and Windows 11. The advisory also details a code execution escalation technique involving UUID brute-forcing to achieve a desired XOR key. The EPSS score is approximately 0.012% (very low), and there is no evidence of active in-the-wild exploitation or CISA KEV catalog inclusion at this time. The vulnerability is detected by Nessus (plugin 298302) and Qualys (detection ID 6275386) (GitHub Advisory, Feedly).

1. Craft malicious EPUB: Create an EPUB archive with a META-INF/encryption.xml containing a CipherReference URI with path traversal sequences (e.g., URI="../../../../../../home/user/.profile" on Linux or URI="../../../../../../temp/target.txt" on Windows) pointing to a target file outside the EPUB extraction directory.
2. Embed a weaponized UUID: In OEBPS/content.opf, set the book's UUID to a value whose SHA-1 hash produces the desired XOR key. For code execution, brute-force a UUID such that SHA1(UUID) XORs the known content of the target file (e.g., # ~/ in ~/.profile) into a shell command (e.g., sh;# or id;#).
3. Package the EPUB: Assemble the EPUB zip archive with the malicious encryption.xml, container.xml, and content.opf files.
4. Deliver to victim: Distribute the malicious EPUB via email, download link, or other social engineering vector, instructing the victim to convert it using Calibre.
5. Trigger conversion: The victim opens Calibre and uses "Convert books" (GUI) or runs ebook-convert malicious.epub output.mobi (CLI), triggering process_encryption() to resolve the traversal path and call decrypt_font(), which XOR-corrupts the first ~1KB of the target file.
6. Achieve code execution: If ~/.profile was targeted with a crafted UUID, the next time the user logs in or sources their profile, the corrupted file executes the injected shell command (e.g., spawning an interactive shell with user privileges) (GitHub Advisory).

• File System: Unexpected modification timestamps on files such as ~/.profile, ~/.bash_profile, /etc/profile, SSH config files, or application databases; first ~1KB of affected files containing garbled/XOR-corrupted binary data inconsistent with original content.
• Process: ebook-convert or Calibre GUI process (calibre, calibre-debug) accessing files outside the user's EPUB library or temporary conversion directories; unusual file open calls to paths like /home/user/.profile or system config files during EPUB conversion.
• Logs: System audit logs (e.g., auditd) showing write access to sensitive files by the Calibre process; shell initialization errors or unexpected interactive shell spawns at login time following EPUB conversion activity.
• Network: Receipt of unsolicited EPUB files from unknown senders via email or messaging platforms, particularly those prompting conversion (GitHub Advisory).

Upgrade Calibre to version 9.2.0 or later, which introduces a boundary check using is_existing_subpath() to prevent path traversal outside the EPUB container directory (Patch Commit). As a temporary workaround, avoid converting EPUB files from untrusted or unknown sources, and restrict the file system permissions of the user account running Calibre to minimize the blast radius of potential file corruption. Debian LTS users should apply the backported fix available via the Debian LTS security announcement (Debian LTS).

The vulnerability was credited to researchers 0x5t and CiviledCode in the GitHub Security Advisory. A technical write-up was published at https://0x5t.raptx.org/posts/calibre-epub-rce and https://infinitsec.net/posts/cve-2026-25636-calibre-has-a-path-traversal-leading-to-arbitrary-file-corruption-and-code-execu, detailing the code execution escalation path. Red Hat tracked the vulnerability and Debian issued a LTS security update (DLA-4554-1) in April 2026. The vulnerability received coverage from security news aggregators including The Hacker Wire and Linux security outlets (GitHub Advisory, Debian LTS).