Calibre, a cross‑platform e‑book manager, suffers from a path traversal flaw in its handling of images referenced within Markdown and similar text files. An attacker can craft an input that causes the conversion process to read arbitrary files from the file system and embed them in the resulting book. In addition, the ebook reader web view provides a background‑image endpoint that lacks authentication and is vulnerable to server‑side request forgery, enabling the exfiltration of the included files without further interaction.

The affected product is the Calibre e‑book manager developed by Kovid Goyal. All releases prior to version 9.6.0 are vulnerable. This includes versions 9.5.x and earlier, as the fix was introduced in 9.6.0.

The CVSS score of 8.2 indicates a high severity vulnerability. While the EPSS score is not available, the absence from CISA’s KEV catalog does not reduce the risk; attackers can exploit the flaw remotely by providing a malicious file for conversion or by interacting with the unprotected web view endpoint. The attack vector is inferred to be remote, given the web component and the ability to supply arbitrary file references. An exploited vulnerability would compromise confidentiality by exposing sensitive files stored on the host system.