CVE-2026-30853
Medium · 5.0CVSS
5.0
EPSS
0.2%
Published
Mar 13, 2026
CISA due date
—
The record
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py) allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a crafted .rb file. This is the same bug class fixed in CVE-2026-26065 for the PDB readers, but the fix was never applied to the RB reader. This vulnerability is fixed in 9.5.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | calibre | 0 | 9.7.0-1.1 |
Related vulnerabilities
- CVE-2026-53511 calibre is an e-book manager. Also affects calibre
- CVE-2026-33205 calibre is a cross-platform e-book manager for viewing, converting, editing, and… Also affects calibre
- CVE-2026-33206 calibre is a cross-platform e-book manager for viewing, converting, editing, and… Also affects calibre
- CVE-2026-27810 calibre is a cross-platform e-book manager for viewing, converting, editing, and… Also affects calibre
- CVE-2026-27824 calibre is a cross-platform e-book manager for viewing, converting, editing, and… Also affects calibre
- CVE-2026-26065 calibre is a cross-platform e-book manager for viewing, converting, editing, and… Also affects calibre
- CVE-2026-26064 calibre is a cross-platform e-book manager for viewing, converting, editing, and… Also affects calibre
- CVE-2026-25731 calibre is an e-book manager. Also affects calibre