calibre
v9.18.0The official source code repository for the calibre ebook manager
- Maintenance
- Active1077 commits in 3 months · bus factor 1
- License
- GPL-3.0Copyleft · OSI-approved
- Security
- 29 advisories3 critical, 9 high, 14 medium, 3 low · Scorecard 6.0/10
- Supported versions
- No scheduleendoflife.date does not track this project
26.4k stars · 2.8k forks · 6 open issues · last release 9 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 29 most recent advisories published by the maintainers: 3 critical, 9 high, 14 medium, 3 low. Check the patched version against the one you run.
- mediumGHSA-jcjq-mph4-hxr5Nov 6, 2026Path traversal in OPF cover resolution enables authenticated remote file disclosure (+ OPF-generation XML injection)
- Affected
- <= 9.17.0
- Patched in
- 9.18.0
- highGHSA-j83h-w5r3-c5ghOct 23, 2026Authentiated RCE via downloaded_recipe Format Whitelist Bypass Leading to Recipe Python exec() During Conversion in calibre Content Server
- Affected
- v9.15.0
- Patched in
- 9.16.0
- mediumGHSA-p6vv-c8p7-3gq5Oct 23, 2026Path Traversal in added_formats ext Parameter Allows Arbitrary File Write via /cdb/set-fields in calibre Content Server
- Affected
- v9.15.0
- Patched in
- 9.16.0
- lowGHSA-68wg-qw9g-48j2Oct 23, 2026SMTP password response exposed in logs — incomplete AUTH redaction in calibre 9.16.0
- Affected
- <= 9.16.0
- Patched in
- 9.17.0
- mediumGHSA-j84x-7j7f-vwx9Oct 23, 2026Heap out-of-bounds write in the HTML entity decoder (output buffer sized input_sz+1)
- Affected
- <= 9.16.0
- Patched in
- 9.17.0
- lowGHSA-xw2w-f6fw-hpxfOct 23, 2026Content server: unbounded request body via chunk size, and amplified Range responses
- Affected
- <= 9.16.0
- Patched in
- 9.17.0
- lowGHSA-j37g-5m8g-28gmOct 23, 2026Content server: extra_books returns metadata for books hidden by a user's library restriction
- Affected
- <= 9.16.0
- Patched in
- 9.17.0
- mediumGHSA-gr6x-pmw6-7mv2Oct 23, 2026Incomplete fix for GHSA-p822-wwqx-p8q5: output_fmt in /conversion/start still writes outside the job directory, and conversion jobs are not tied to the user who started them
- Affected
- >= 9.14.0, <= 9.16.0
- Patched in
- 9.17.0
- mediumGHSA-p6rh-fpfg-37w2Sep 18, 2026Remote arbitrary file read via unvalidated conversion options in content server
- Affected
- <=9.14
- Patched in
- 9.15
- mediumGHSA-878g-j7cg-mqvrAug 28, 2026Stored cross-site scripting in legacy content server book details via crafted identifier metadata
- Affected
- <=9.13
- Patched in
- 9.14
- highGHSA-8rcp-ffwf-rf64Aug 28, 2026Heap overflow in cpalmdoc_compress()
- Affected
- <= 9.12.0
- Patched in
- 9.13.0
- mediumGHSA-36r8-fcxw-vmjhAug 28, 2026RCE via incomplete recipe format blacklist in Content Server upload endpoints (downloaded_recipe bypass)
- Affected
- <= 9.13.0
- Patched in
- 9.14.0
- mediumGHSA-p822-wwqx-p8q5Aug 28, 2026Path traversal in Content Server /conversion/start via unvalidated output_fmt allows arbitrary file write
- Affected
- <= 9.13.0
- Patched in
- 9.14.0
- mediumGHSA-hxg6-6p6q-j7h7Aug 28, 2026Path traversal in /cdb/cmd/add via unsanitized fname allows arbitrary content write to any filesystem path
- Affected
- <= 9.13.0
- Patched in
- 9.14.0
- mediumGHSA-qp96-hggr-hw3gAug 28, 2026Arbitrary file write via import of ".fb2" books
- Affected
- <= 9.13.0
- Patched in
- 9.14.0
- highCVE-2026-73249Aug 2, 2026calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification
- Affected
- 9.11.0
- Patched in
- 9.12.0
- highCVE-2026-73248Aug 2, 2026Arbitrary code execution via nested `template()` that bypasses Python template restrictions
- Affected
- <= 9.11.0
- Patched in
- 9.12.0
- highCVE-2026-53511Jun 26, 2026Arbitrary Code Execution in Template Formatter via Book Metadata
- Affected
- <= 9.9.0
- Patched in
- 9.10.0
- highCVE-2026-33206Mar 27, 2026Path traversal allows reading arbitrary files when converting a text-based file
- Affected
- <=9.5
- Patched in
- 9.6
- mediumCVE-2026-33205Mar 27, 2026Server-Side Request Forgery in ebook viewer backend
- Affected
- <=9.5
- Patched in
- 9.6
- mediumCVE-2026-30853Mar 13, 2026Path Traversal Leading to Arbitrary File Write
- Affected
- <= 9.4.0
- Patched in
- 9.5.0
- mediumCVE-2026-27810Feb 27, 2026HTTP Response Header Injection
- Affected
- <= 9.3.1
- Patched in
- 9.4.0
- mediumCVE-2026-27824Feb 27, 2026IP Ban Bypass via X-Forwarded-For Header Spoofing
- Affected
- <= 9.3.1
- Patched in
- 9.4.0
- criticalCVE-2026-26064Feb 20, 2026Path Traversal Leading to Arbitrary File Write and Potentially Code Execution
- Affected
- < 9.2.1
- Patched in
- 9.3.0
- criticalCVE-2026-26065Feb 20, 2026Path Traversal Leading to Arbitrary File Write and Potentially Code Execution
- Affected
- < 9.2.1
- Patched in
- 9.3.0
- highCVE-2026-25636Feb 6, 2026Path Traversal Leading to Arbitrary File Corruption and Code Execution
- Affected
- 9.1.0
- highCVE-2026-25635Feb 6, 2026Path Traversal Leading to Arbitrary File Write and Potential Code Execution
- Affected
- < 9.2.0
- Patched in
- 9.2.0
- highCVE-2026-25731Feb 6, 2026Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export
- Affected
- <= 9.1.0
- Patched in
- 9.2.0
- criticalCVE-2025-64486Nov 7, 2025Arbitrary code execution in Calibre when opening FB2 files
- Affected
- <=8.13.0
- Patched in
- 8.14.0