CVE-2026-26065: 
NixOS vulnerability analysis and mitigation

CVE-2026-26065 is a path traversal vulnerability in calibre's eReader PDB readers (both 132-byte and 202-byte header variants) that allows arbitrary file writes with arbitrary extension and content anywhere the user has write permissions. It affects calibre versions 9.2.1 and below, and was disclosed on February 20, 2026, with a fix released in version 9.3.0. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In both reader132.py and reader202.py, the image name field (a 32-byte value embedded in PDB records) is read directly from attacker-controlled binary data without sanitization — no os.path.basename() call, no extension check, and no content validation. When extract_content() enters the images/ subdirectory via CurrentDir and calls open(name, 'wb'), path traversal sequences (e.g., ../../../../../../pdb_rce.bat) in the name field cause files to be written outside the intended directory, silently overwriting any existing file. The data.startswith(b'PNG') check in reader202.py is only a record-type marker and does not constrain the filename or content (GitHub Advisory, GitHub Commit).

Successful exploitation allows an attacker to write arbitrary files with arbitrary content and any file extension to any location the calibre process user has write access to, enabling potential code execution (e.g., by placing a malicious .bat or script file in a startup or user-accessible directory) and denial of service through silent overwriting of critical files. Confirmed on Windows 11 x64, the attack can write files to locations such as %APPDATA% and %USERPROFILE%. The vulnerability affects confidentiality, integrity, and availability at both the vulnerable and subsequent system levels (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit (create_poc.py) is publicly available via the GitHub security advisory, generating both poc_132.pdb and poc_202.pdb files that demonstrate the arbitrary file write. Exploitation requires user interaction — specifically, a victim must open or convert a malicious PDB file using calibre's GUI. There is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.007% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Craft a malicious PDB file: Use the public PoC generator (create_poc.py) or manually construct a PDB file with image records where the 32-byte name field contains a path traversal sequence (e.g., ../../../../../../pdb_rce.bat) and the data field contains arbitrary content (e.g., a batch script or executable payload).
2. Deliver the malicious PDB: Distribute the crafted .pdb file to the target user via email, download link, or any social engineering vector, disguised as a legitimate e-book.
3. Trigger conversion: Convince the victim to open or convert the PDB file using calibre's GUI ("Convert books" function), which invokes the vulnerable extract_content() method in reader132.py or reader202.py.
4. Path traversal executes: When calibre processes the image records, open(name, 'wb') resolves the traversal path and writes the attacker-controlled content (e.g., a .bat file) to the target directory (e.g., %APPDATA% or %USERPROFILE%) outside the intended images/ subdirectory.
5. Achieve code execution or DoS: The written file (e.g., a startup script or executable) is subsequently executed by the OS or user, achieving code execution; alternatively, overwriting critical system or application files causes denial of service (GitHub Advisory).

• File System: Unexpected files with non-image extensions (e.g., .bat, .exe, .ps1, .vbs) appearing in directories such as %APPDATA%, %USERPROFILE%, or other user-writable locations following calibre PDB conversion activity; files with names matching traversal patterns written outside calibre's working directory.
• Logs: Calibre debug logs containing entries such as Writing image ../../../../../<filename> to images/ indicating traversal paths were used during image extraction.
• Process: Unexpected script or executable processes (e.g., cmd.exe, powershell.exe) spawned shortly after calibre performs a PDB book conversion, particularly if the parent process is calibre.
• Network: Outbound connections from the calibre process or newly written scripts to unknown external hosts following a PDB file conversion event (GitHub Advisory).

Upgrade calibre to version 9.3.0 or later, which introduces path validation in both reader132.py and reader202.py via an image_dest() method that checks extracted image paths against the intended output directory using os.path.commonprefix(). Until patching is complete, avoid opening or converting PDB files from untrusted sources, and restrict calibre's write permissions to only necessary directories. No other official workaround has been published (GitHub Commit, GitHub Advisory).

The vulnerability received coverage from security news outlets including The Hacker Wire and SecurityOnline.info, with the latter describing it as exposing readers to remote code execution via "poisoned pages." Linux distribution maintainers responded with patches; Debian issued DLA-4554-1 for calibre in April 2026, and the vulnerability was included in the Debian 12.14 and 13.5 point releases. The SANS Internet Stormcast podcast also covered the issue. Social media discussion was noted on Mastodon via The Hacker Wire's account (The Hacker Wire, Debian Advisory).