Calibre versions prior to 9.5.0 contain a path traversal flaw in the RocketBook (.rb) input plugin that allows an attacker to write arbitrary files to any location writable by the calibre process when a user opens or converts a crafted .rb file. This weakness, classified as CWE-22, enables malicious code to create or overwrite files, potentially compromising the confidentiality and integrity of the system or affecting exposed resources. The flaw does not provide remote code execution but can be used to write malicious binaries, configuration files, or other payloads that may be executed later by the user or privileged processes.

The product affected is kovidgoyal:calibre, available as calibre-ebook:calibre. All releases before version 9.5.0 are vulnerable. The issue is present across all supported operating systems as calibre is cross-platform.

The CVSS score of 5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to open a specifically crafted .rb file, so the attack vector is local and user-interactive. While the impact is limited to environments where calibre runs with elevated or system-level privileges, the lack of remote exploitation reduces overall risk for typical deployments.