CVE-2026-33205

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

Calibre before version 9.12.0 processes attacker-controlled composite_template metadata from malicious EPUB, OPF, PDF, or similar files through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.

A vulnerability in calibre prior to version 9.10.0 allows arbitrary Python code execution via a malicious EPUB, OPF, or PDF file. An attacker can embed a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter.

Prior to version 9.6.0, calibre has a path traversal vulnerability in handling images in Markdown and similar text-based files, allowing inclusion of arbitrary files from the file system into the converted book. Missing authentication and SSRF in the background-image endpoint of the ebook reader web view allow exfiltration without additional interaction.