The vulnerability of the extract_pictures() function in the Calibre electronic library software lies in the improper restriction on the path to the restricted catalog. This allows attackers to bypass existing security mechanisms and execute arbitrary code.

The vulnerability of the extractpictures function in the Calibre electronic library software is related to an incorrect restriction on the path to the restricted-access catalog. Exploiting this vulnerability could allow a perpetrator to bypass existing security mechanisms and execute arbitrary co...

CVE-2026-26064: Improper Limitation of a Pathname to a Restricted Directory

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writin...