CVE-2026-53511
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A vulnerability in calibre prior to version 9.10.0 allows arbitrary Python code execution via a malicious EPUB, OPF, or PDF file. An attacker can embed a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter.
Risk Assessment
The risk for the organization is that an attacker can gain control of the system by delivering a malicious e-book file. This could lead to data theft, malware installation, or further network compromise.
Recommendation
Immediately update calibre to version 9.10.0 or later. Before updating, avoid adding or editing metadata of untrusted EPUB, OPF, and PDF files.
Other vulnerabilities in calibre
See all- CVE-2026-73249High
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.
- CVE-2026-73248High
Calibre before version 9.12.0 processes attacker-controlled composite_template metadata from malicious EPUB, OPF, PDF, or similar files through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.
- CVE-2026-33206Medium
Prior to version 9.6.0, calibre has a path traversal vulnerability in handling images in Markdown and similar text-based files, allowing inclusion of arbitrary files from the file system into the converted book. Missing authentication and SSRF in the background-image endpoint of the ebook reader web view allow exfiltration without additional interaction.
- CVE-2026-33205Medium
calibre contains a Server-Side Request Forgery vulnerability in the background-image endpoint of its web view. An attacker can perform blind GET requests to arbitrary URLs and exfiltrate information out of the ebook sandbox. Version 9.6.0 patches the issue.
Original NVD description (English source)
calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter. This issue is fixed in version 9.10.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS