calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem path and opens it in read-write mode, even when it points outside the conversion extraction directory. This vulnerability is fixed in 9.2.0.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9f2b45e4c1 advisory.

    Update to 9.13.0.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c10ed2f3b7 advisory.

    Update to 9.13.0.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4744 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4744-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     August 18, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : calibre     Version        : 6.13.0+repack-2+deb12u10     CVE ID         : CVE-2026-53511

    It was discovered that a malicious EPUB, OPF or PDF file can execute     arbitrary Python code when its metadata is read by calibre, an e-book     manager.

    There was a regression introduced by the fix of CVE-2026-25636. It is     also fixed in this update.

    For Debian 12 bookworm, this problem has been fixed in version     6.13.0+repack-2+deb12u10.

    We recommend that you upgrade your calibre packages.

    For the detailed security status of calibre please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/calibre

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4554 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4554-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     April 29, 2026                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : calibre     Version        : 5.12.0+dfsg-1+deb11u4     CVE ID         : CVE-2025-64486 CVE-2026-25635 CVE-2026-25636 CVE-2026-26064                      CVE-2026-26065

    Multiple vulnerabilities have been discovered in calibre, an e-book     manager

    CVE-2025-64486

        calibre does not validate filenames when handling binary assets in         FB2 files, allowing an attacker to write arbitrary files on the         filesystem when viewing or converting a malicious FictionBook         file. This can be leveraged to achieve arbitrary code execution.

    CVE-2026-25635

        Calibre's CHM reader contains a path traversal vulnerability that         allows arbitrary file writes anywhere the user has write         permissions.

    CVE-2026-25636

        a path traversal vulnerability in Calibre's EPUB conversion allows         a malicious EPUB file to corrupt arbitrary existing files writable         by the Calibre process

    CVE-2026-26064

        a path traversal vulnerability that allows arbitrary file writes         anywhere the user has write permissions.

    CVE-2026-26065

        Path Traversal through PDB readers that allow arbitrary file         writes with arbitrary extension and arbitrary content anywhere the         user has write permissions. Files are written in 'wb' mode,         silently overwriting existing files. This can lead to potential         code execution and Denial of Service through file corruption.

    For Debian 11 bullseye, these problems have been fixed in version     5.12.0+dfsg-1+deb11u4.

    We recommend that you upgrade your calibre packages.

    For the detailed security status of calibre please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/calibre

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB     conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre     process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an     absolute filesystem path and opens it in read-write mode, even when it points outside the conversion     extraction directory. This vulnerability is fixed in 9.2.0. (CVE-2026-25636)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
339190	Fedora 44 : calibre (2026-9f2b45e4c1)	Nessus	Fedora Local Security Checks	Local	high
338790	Fedora 43 : calibre (2026-c10ed2f3b7)	Nessus	Fedora Local Security Checks	Local	high
337080	Debian dla-4744 : calibre - security update	Nessus	Debian Local Security Checks	Local	high
311182	Debian dla-4554 : calibre - security update	Nessus	Debian Local Security Checks	Local	critical
298302	Linux Distros Unpatched Vulnerability : CVE-2026-25636	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-25636

high

Tenable Plugins

high

high

high

critical

high