Calibre-ebook Calibre
20 CVEs affecting Calibre-ebook Calibre. Latest disclosed: 2026-03-27. Critical: 2, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2011-4125 | Critical | 9.8 | 2021-10-27 | A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute any program as root. |
CVE-2011-4124 | Critical | 9.8 | 2021-10-27 | Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privileges. |
CVE-2026-26065 | High | 8.8 | 2026-02-20 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal… |
CVE-2026-26064 | High | 8.8 | 2026-02-20 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerab… |
CVE-2026-25635 | High | 8.6 | 2026-02-06 | calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user… |
CVE-2026-25636 | High | 8.2 | 2026-02-06 | calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitra… |
CVE-2011-4126 | High | 8.1 | 2021-10-27 | Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere. |
CVE-2026-25731 | High | 7.8 | 2026-02-06 | calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary co… |
CVE-2018-7889 | High | 7.8 | 2018-03-08 | gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a craf… |
CVE-2024-6781 | High | 7.5 | 2024-08-06 | Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read. |
CVE-2023-46303 | High | 7.5 | 2023-10-22 | link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root. |
CVE-2021-44686 | High | 7.5 | 2021-12-07 | calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conve… |
CVE-2026-27810 | Medium | 6.4 | 2026-02-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection… |
CVE-2026-33206 | Medium | 6.3 | 2026-03-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a path traversal vulnerability exi… |
CVE-2026-33205 | Medium | 5.5 | 2026-03-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Server-Side Request Forgery vuln… |
CVE-2016-10187 | Medium | 5.5 | 2017-03-16 | The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript. |
CVE-2024-7008 | Medium | 5.4 | 2024-08-06 | Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting. |
CVE-2026-27824 | Medium | 5.3 | 2026-02-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute… |
CVE-2026-30853 | Medium | 5.0 | 2026-03-13 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the Rock… |
CVE-2024-7009 | Medium | 4.2 | 2024-08-06 | Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database. |