CVE-2026-26064: 
NixOS vulnerability analysis and mitigation

CVE-2026-26064 is a path traversal vulnerability in calibre, a cross-platform e-book manager, that allows arbitrary file writes to any location the user has write permissions. Affecting calibre versions 9.2.1 and below, the flaw resides in the extract_pictures() function within src/calibre/ebooks/odt/input.py. On Windows systems, exploitation can lead to Remote Code Execution (RCE) by writing a malicious payload to the Startup folder, which executes on the next user login. The vulnerability was disclosed on February 20, 2026, and carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), specifically in the extract_pictures() function in src/calibre/ebooks/odt/input.py. The function only checks whether a ZIP entry name starts with 'Pictures' but fails to sanitize .. sequences, allowing path traversal. While calibre's own ZipFile.extractall() in utils/zipfile.py correctly sanitizes .. via _get_targetpath(), extract_pictures() bypasses this protection by using manual zf.read() + open() calls without path validation. An attacker crafts a malicious ODT file (which is a ZIP archive) containing an entry such as Pictures/../../../../../Roaming/Microsoft/Windows/STARTM~1/Programs/Startup/rce.bat; when a victim converts this file via calibre's GUI, the payload is written to the Windows Startup folder and executes on next login (GitHub Advisory, GitHub Commit).

Successful exploitation allows an attacker to write arbitrary files to any location accessible by the victim user, with the most severe consequence on Windows being Remote Code Execution via the Startup folder persistence mechanism. The vulnerability has HIGH impact on confidentiality, integrity, and availability of the affected system. An attacker who tricks a user into converting a malicious ODT file can achieve persistent code execution with the victim's user privileges, potentially enabling credential theft, lateral movement, or further system compromise (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept (PoC) generator script (create_poc.py) is publicly documented in the GitHub Security Advisory, demonstrating creation of a malicious ODT file that triggers the vulnerability. The advisory confirms the attack was verified on calibre 9.2.1 on Windows 11 (x64) by triggering the "Convert books" GUI function. As of disclosure, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is 0.01% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog. Detection signatures are available via Nessus (plugin 299678) and Qualys (detection ID 6275397) (GitHub Advisory, Feedly).

1. Craft a malicious ODT file: Use a PoC script (e.g., create_poc.py as referenced in the advisory) to create a ZIP-based ODT file containing a crafted entry with a path-traversal sequence, such as Pictures/../../../../../AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/rce.bat, embedding a malicious payload (e.g., a batch script launching a reverse shell or arbitrary executable).
2. Deliver the malicious ODT to the victim: Use social engineering, phishing, or any file-sharing mechanism to deliver the crafted poc.odt file to a target running calibre 9.2.1 or earlier on Windows.
3. Trigger conversion: Convince the victim to open calibre and use the "Convert books" feature on the malicious ODT file. This invokes extract_pictures(), which processes the ZIP entries without sanitizing .. sequences.
4. Payload written to Startup folder: The open(name, 'wb') call resolves the traversal path and writes the attacker-controlled payload (e.g., rce.bat) directly to the Windows Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\).
5. Achieve code execution on next login: Upon the victim's next Windows login, the payload in the Startup folder executes automatically with the user's privileges, completing the RCE chain (GitHub Advisory).

• File System: Unexpected files (e.g., .bat, .exe, .ps1, .vbs) appearing in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ with creation timestamps correlating to calibre usage; unexpected files written outside the calibre working directory during an ODT conversion.
• Process: Unusual child processes spawned at Windows login originating from the Startup folder, particularly those not associated with legitimate installed software; processes launched by explorer.exe or userinit.exe from the Startup path that are unexpected.
• Logs: Windows Event Logs (Event ID 4688 or Sysmon Event ID 1) showing process creation from %APPDATA%\...\Startup\ at login time; file creation events (Sysmon Event ID 11) in the Startup folder triggered by the calibre process (calibre.exe or calibre-debug.exe).
• Network: Outbound connections from processes launched via the Startup folder to unknown external IP addresses, potentially indicating a reverse shell or C2 beacon established post-exploitation (GitHub Advisory).

The vulnerability is fixed in calibre version 9.3.0, which adds proper path validation in extract_pictures() by computing the absolute destination path and verifying it shares a common prefix with the intended base directory before writing any file. Users running calibre 9.2.1 or earlier should upgrade to 9.3.0 immediately, with particular urgency for Windows environments due to the RCE risk. No official configuration-based workaround has been published; as an interim measure, users should avoid converting untrusted ODT files until the patch is applied. Debian LTS users can apply the fix via the debian-lts-announce advisory (DLA-4554-1) (GitHub Commit, GitHub Advisory, Feedly).

The Hacker Wire published a dedicated article covering the path traversal flaw and its Windows RCE implications, and shared it on Mastodon and Bluesky (The Hacker Wire). Security Online Info covered the vulnerability under the headline "Poisoned Pages: Critical Calibre Path Traversal Flaws Expose Readers to RCE," highlighting the risk to end users who open untrusted e-books. The SANS Internet Stormcast podcast (episode 9822) also mentioned the vulnerability. Linux-focused outlets such as 9to5Linux and Linuxiac covered the calibre 9.3.0 release, noting the security fix alongside feature improvements.