CVE-2026-33206: 
NixOS vulnerability analysis and mitigation

CVE-2026-33206 is a relative path traversal vulnerability (CWE-23) in Calibre, a cross-platform e-book manager, affecting all versions prior to 9.6.0. The flaw exists in Calibre's handling of images embedded in Markdown and other text-based files during format conversion, allowing an attacker to include arbitrary files from the file system into the converted e-book. When chained with a related SSRF/missing authentication issue (GHSA-4926-v9px-wv7v) in the ebook reader's background-image endpoint, arbitrary files can be exfiltrated to an attacker-controlled server without additional user interaction. The vulnerability was published on March 27, 2026, with a fix released in version 9.6.0. It carries a CVSS v3.1 score of 6.3 (Medium) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory).

The root cause is an insufficient path sanitization check in ebooks/conversion/plugins/txt_input.py within the fix_resources method. When converting Markdown or plaintext files to other formats, Calibre resolves image src attributes by joining them with the base directory and then performs only a startswith check against the normalized base path — without first normalizing or sanitizing the constructed path. This means a crafted src value such as ../../../../../../../../etc/passwd passes the check because the unnormalized joined path still starts with the base directory string before the ../ sequences are resolved. The attacker delivers a malicious Markdown file containing an <img> tag with a traversal payload; when the victim opens or converts the file in Calibre, the referenced file is read and embedded in the output. Combined with GHSA-4926-v9px-wv7v (missing authentication on the background-image endpoint), the embedded file content is also exfiltrated to an attacker-controlled server (GitHub Advisory).

Successful exploitation allows an attacker to read arbitrary files accessible to the Calibre process on the victim's file system — including sensitive files such as /etc/passwd, SSH private keys, configuration files, or credential stores — and exfiltrate them to an attacker-controlled server. The confidentiality impact is high for both the vulnerable system and subsequent systems, while integrity and availability are unaffected. The path traversal alone affects all platforms (Linux, Windows, macOS), though the SSRF-based exfiltration component is limited to POSIX systems in the described PoC (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including a Python PoC server (poc.py) and a sample malicious Markdown file with the payload <img src="../../../../../../../../etc/passwd">. Exploitation requires the victim to open or convert a malicious document in Calibre (passive user interaction), but no privileges are required on the attacker's side. There is no evidence of in-the-wild exploitation at this time, and the EPSS score is approximately 0.021% (very low). The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Prepare malicious Markdown file: Create a Markdown file containing an image tag with a path traversal payload targeting a sensitive file, e.g., <img src="../../../../../../../../etc/passwd"> (adjust traversal depth as needed for the target system).
2. Set up exfiltration server: Run the PoC Python server (python3 poc.py) on an attacker-controlled host reachable from the target machine. This server listens for incoming requests that will carry the exfiltrated file contents via the SSRF/background-image endpoint (GHSA-4926-v9px-wv7v).
3. Deliver the malicious file: Distribute the crafted Markdown file to the target user via email, file sharing, or any social engineering vector. The file must be opened or converted using Calibre on the victim's machine.
4. Victim opens the file: When the victim opens the Markdown file in Calibre's ebook reader or initiates a format conversion, Calibre's fix_resources method resolves the traversal path, reads the target file (e.g., /etc/passwd), and embeds it in the output.
5. File exfiltration: Due to the missing authentication on the background-image endpoint, the embedded file content is automatically sent to the attacker's PoC server without further user interaction. The attacker inspects the server output to retrieve the exfiltrated file.
6. Alternative (offline): If exfiltration via SSRF is not possible (e.g., on Windows), the attacker can instruct the victim to convert the Markdown to EPUB and share the output; the target file will appear embedded in the EPUB archive (GitHub Advisory).

• File System: Presence of unexpected files (e.g., files named after sensitive system files like .passwd) embedded within converted EPUB or other e-book output files in Calibre's output directory.
• Network: Outbound HTTP requests from the Calibre process or the host to an unknown external IP/domain, particularly requests carrying file content in the body or as a background-image resource, originating from the ebook reader web view.
• Logs: System or application logs showing Calibre reading files outside of the expected e-book source directory (e.g., access to /etc/passwd, ~/.ssh/id_rsa, or other sensitive paths) during a conversion or open operation.
• Process: Calibre process (calibre, ebook-convert) accessing files in directories unrelated to the e-book being processed, observable via file access monitoring tools (e.g., auditd on Linux, Sysmon on Windows) (GitHub Advisory).

Calibre version 9.6.0 contains a fix for this vulnerability and should be applied immediately. Users can download the patched version from the official Calibre website. As interim workarounds: avoid opening or converting Markdown or other text-based e-book files from untrusted sources; restrict Calibre's ebook conversion and reader functionality to trusted users and documents; and consider implementing network segmentation or host-based firewall rules to prevent outbound connections from the Calibre process, limiting the impact of the SSRF-based exfiltration component (GitHub Advisory, Calibre Download).

The vulnerability was reported by security researcher emilvirkki and disclosed via GitHub's coordinated disclosure process. A Tenable Nessus detection plugin (ID 304172) was published to help identify vulnerable Calibre installations. Community discussion noted the release of Calibre 9.6.0 with the fix, including mentions on Linux community forums and German-language security news outlets. No major vendor statements beyond the official advisory have been identified (GitHub Advisory, Tenable Plugin).