CVE-2026-30853: 
NixOS vulnerability analysis and mitigation

CVE-2026-30853 is a path traversal vulnerability in calibre's RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py) that allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a crafted .rb file. It affects all calibre versions prior to 9.5.0 (≤ 9.4.0) across Linux and Windows platforms. The vulnerability was published on March 13, 2026, and patched in calibre 9.5.0. It carries a CVSS v3.1 base score of 8.2 (High) per Feedly threat intelligence data, though the GitHub advisory rates it 5.0 (Moderate) using a more conservative vector (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). In rb/reader.py, the get_toc() function reads a 32-byte TOC entry name from attacker-controlled binary data and URL-decodes it without any path sanitization. Both get_text() and get_image() then pass this unsanitized name directly to os.path.join(output_dir, name) and open the result for writing — when the name is an absolute path (e.g., /home/user/evil.png), Python's os.path.join discards output_dir entirely, and relative traversal sequences like ../../evil.html also work. The patched PDB readers (reader132.py, reader202.py) use an image_dest() helper with a commonprefix boundary check, but this fix was never applied to the RB reader (the same bug class as CVE-2026-26065). The .png code path writes fully attacker-controlled raw bytes, while the .html path applies cp1252→UTF-8 re-encoding (GitHub Advisory).

Successful exploitation allows an attacker to write arbitrary files — with fully controlled content via the .png path — to any filesystem location writable by the calibre process, including the user's home directory and Desktop. This can result in overwriting existing files (data destruction), planting malicious payloads in startup directories or shell configuration files, and potentially achieving code execution. Confidentiality is not directly impacted, but integrity and availability are both rated High in the Feedly CVSS assessment, reflecting the risk of system compromise (GitHub Advisory, Red Hat Bugzilla).

A complete, runnable proof-of-concept Python script (make_poc_rb.py) is publicly available in the GitHub security advisory, which generates a malicious .rb file and demonstrates arbitrary file write via ebook-convert malicious.rb output.epub. No privileges are required; exploitation only requires user interaction (opening or converting the crafted file). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is 0.000110 (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Craft the malicious .rb file: Run the public PoC generator make_poc_rb.py to produce a valid RocketBook file with a TOC entry whose 32-byte name field contains an absolute path (e.g., /tmp/CALIBRE_RB_POC.png) or a relative traversal sequence (e.g., ..\..\..\..\..\Desktop\x.png on Windows). The content block is set to the attacker's desired payload bytes (e.g., a shell script).
2. Deliver the file to the target: Social-engineer the victim into receiving the crafted .rb file via email, file sharing, or by placing it in a directory the user is likely to open (e.g., a shared e-book library folder).
3. Trigger conversion or opening: The victim opens the file in calibre or runs ebook-convert malicious.rb output.epub. The conversion will error with "Spine is empty" — this is expected and does not prevent the file write.
4. Arbitrary file write occurs: During processing, get_toc() reads the unsanitized TOC name, and get_image() calls open(os.path.join(output_dir, name), 'wb'). Because name is an absolute path, os.path.join discards output_dir and writes the payload directly to the attacker-specified location.
5. Achieve code execution (optional): If the payload is written to a location that is executed automatically (e.g., ~/.bashrc, a startup script, or a Windows Startup folder), the attacker achieves code execution upon the next user login or shell invocation. Verify with ls -la /tmp/CALIBRE_RB_POC.png or xxd /tmp/CALIBRE_RB_POC.png (GitHub Advisory).

• File System: Unexpected files appearing in user home directories, Desktop, /tmp/, or shell configuration files (e.g., ~/.bashrc, ~/.profile) with unusual content or timestamps coinciding with calibre usage; files with image extensions (.png) that are identified by file as shell scripts or other non-image types.
• Process: The calibre process (calibre, ebook-convert) spawning child processes or writing files outside its expected output directory; ebook-convert invocations on .rb files from untrusted sources.
• Logs: Calibre conversion logs showing "Spine is empty" errors immediately after processing a .rb file, which is a known side effect of exploitation; filesystem audit logs (e.g., auditd on Linux) recording unexpected file creation events by the calibre process outside its working directory.
• Network: Unusual outbound connections from the calibre process after conversion, which may indicate a dropped payload was executed (GitHub Advisory).

Upgrade calibre to version 9.5.0 or later, which applies the same image_dest() boundary check fix previously used for the PDB readers to the RB reader. Until patching is possible, avoid opening or converting .rb files from untrusted or unknown sources. Additionally, consider restricting filesystem permissions for the calibre process to limit the impact of any potential file writes (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher andrejtomci and disclosed via GitHub's security advisory program. Red Hat tracked it via their Bugzilla system and assigned it medium severity. The HowToGeek publication noted the calibre 9.5.0 release as a security improvement. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database entries.