A path traversal flaw in Calibre’s EPUB conversion process allows a malicious EPUB to resolve a CipherReference URI to an absolute path on the filesystem. When the file points outside the extraction directory, Calibre opens it in read‑write mode, enabling the attacker to corrupt any writable file. Depending on the file overwritten, this can lead to service disruption or execution of arbitrary code. The weakness corresponds to Path Traversal, Absolute Path Traversal, and Code Injection.

Versions of the calibre e‑book manager 9.1.0 and earlier by Kovid Goyal are affected. The issue is fixed in calibre 9.2.0 and later releases.

The vulnerability’s CVSS score of 8.2 indicates high severity, but its EPSS score of less than 1% suggests low current exploitation probability. It is not listed in the CISA KEV catalog. An attacker would supply a crafted EPUB file to the user’s Calibre instance; the exploit relies on write permissions granted to the Calibre process and the presence of a target file that can be overwritten. If successful, the attacker could corrupt configuration files, and based on the vulnerability’s ability to overwrite arbitrary files, it is inferred that replacement of executable binaries or broader host compromise might also be possible.