CVE-2026-26064

🗓️ 20 Feb 2026 01:44:34Reported by Debian Security Bug TrackerType

Calibre up to 9.2.1 has a path traversal flaw enabling arbitrary file writes and Windows remote code execution.

Reporter	Title	Published	Views	Family All 23
BDU FSTEC	The vulnerability of the extract_pictures() function in the Calibre electronic library software lies in the improper restriction on the path to the restricted catalog. This allows attackers to bypass existing security mechanisms and execute arbitrary code.	1 Apr 202600:00	–	bdu_fstec
Circl	CVE-2026-26064	20 Feb 202604:30	–	circl
CNNVD	Calibre 路径遍历漏洞	20 Feb 202600:00	–	cnnvd
CVE	CVE-2026-26064	20 Feb 202601:44	–	cve
Cvelist	CVE-2026-26064 calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution	20 Feb 202601:44	–	cvelist
Debian	[SECURITY] [DLA 4554-1] calibre security update	30 Apr 202611:51	–	debian
Tenable Nessus	Debian dla-4554 : calibre - security update	30 Apr 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-26064	20 Feb 202600:00	–	nessus
NVD	CVE-2026-26064	20 Feb 202602:16	–	nvd
OSV	CVE-2026-26064 calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution	20 Feb 202601:44	–	osv

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	11	any	calibre	5.12.0+dfsg-1+deb11u4	calibre_5.12.0+dfsg-1+deb11u4_any.deb
Debian	12	any	calibre	6.13.0+repack-2+deb12u6	calibre_6.13.0+repack-2+deb12u6_any.deb
Debian	13	any	calibre	8.5.0+ds-1+deb13u2	calibre_8.5.0+ds-1+deb13u2_any.deb
Debian	14	any	calibre	9.3.0+ds+~0.10.5-1	calibre_9.3.0+ds+~0.10.5-1_any.deb
Debian	999	any	calibre	9.3.0+ds+~0.10.5-1	calibre_9.3.0+ds+~0.10.5-1_any.deb

20 Feb 2026 01:44Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.8

CVSS 49.3

EPSS0.0088

SSVC