Calibre extract_pictures() Path Traversal

The vulnerability of the extractpictures function in the Calibre electronic library software is related to an incorrect restriction on the path to the restricted-access catalog. Exploiting this vulnerability could allow a perpetrator to bypass existing security mechanisms and execute arbitrary co...

CVE-2026-26064: Improper Limitation of a Pathname to a Restricted Directory

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writin...