A Server-Side Template Injection flaw in Calibre’s templating engine allows an attacker to embed and execute arbitrary code while converting an e‑book with custom template files supplied through the --template-html or --template-html-index command‑line options. The injection vulnerability means any code can be run in the context of the user running Calibre, potentially compromising the file system, exposing credentials, or installing persistent malware. The weakness is classified as SSTI (CWE‑1336) and involves incorrect template handling (CWE‑917).

The vulnerability affects all Kalidgoyal Calibre releases prior to version 9.2.0. Users running Calibre installed from any source before this version are impacted. Updated binaries from Calibre 9.2.0 and later incorporate the fix that removes the vulnerable templating engine path.

The CVSS score of 7.8 indicates high severity. EPSS is below 1 %, signifying a currently low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to deliver a malicious template file to a user who executes a conversion with the vulnerable options, so the attack vector is most likely local. In environments where users have command‑line or scripting access to Calibre, the risk escalates because an attacker could supply a crafted template without further interaction. The confirmed fix is limited to version 9.2.0 and newer; no publicly documented exploits exist yet, but the potential for abuse remains.