Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-26064 is a critical path traversal vulnerability in the calibre e-book manager, specifically in the function extract_pictures that processes ODT files. This function attempts to extract files starting with 'Pictures' from ODT ZIP archives but fails to sanitize path traversal sequences like '..'. As a result, an attacker can craft a malicious ODT file that writes arbitrary files anywhere the user has write permissions."}, {'type': 'paragraph', 'content': "On Windows, this vulnerability can be exploited to write a malicious payload into the user's Startup folder, which will execute automatically on the next login, leading to remote code execution. The vulnerability bypasses calibre's usual ZIP extraction sanitization because extract_pictures manually reads and writes files without validating the file paths."}] [1]

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': 'This vulnerability allows an attacker to write arbitrary files anywhere the user has write permissions, potentially overwriting important files or placing malicious executables.'}, {'type': 'paragraph', 'content': "On Windows systems, it can lead to remote code execution by placing a malicious batch file in the Startup folder, which runs automatically when the user logs in. This can compromise the user's system, leading to unauthorized control, data loss, or further malware infection."}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for suspicious file writes outside the expected extraction directory when processing ODT files with calibre versions 9.2.1 and below. Specifically, look for files being written to unexpected locations such as the Windows Startup folder.'}, {'type': 'paragraph', 'content': "One way to detect exploitation attempts is to check for the presence of unexpected batch files (e.g., rce.bat) or other files in the user's Startup folder or other sensitive directories."}, {'type': 'paragraph', 'content': "Since the attack is triggered by converting malicious ODT files via calibre's GUI 'Convert books' feature, monitoring file system changes during such conversions can help detect exploitation."}, {'type': 'list_item', 'content': 'On Windows, use PowerShell to check for suspicious files in the Startup folder: Get-ChildItem "$env:APPDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"'}, {'type': 'list_item', 'content': 'Monitor recent file creation timestamps in the Startup folder: Get-ChildItem "$env:APPDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-1) }'}, {'type': 'list_item', 'content': 'Check calibre version installed: calibre --version'}, {'type': 'list_item', 'content': 'Review logs or audit file system changes during ODT file conversions if possible.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The immediate mitigation step is to upgrade calibre to version 9.3.0 or later, where the vulnerability has been fixed by properly sanitizing file paths during extraction.'}, {'type': 'paragraph', 'content': "Until the upgrade is applied, avoid converting untrusted or suspicious ODT files using calibre's 'Convert books' feature."}, {'type': 'paragraph', 'content': 'Additionally, monitor and restrict write permissions to sensitive directories such as the Startup folder to reduce the impact of potential exploitation.'}, {'type': 'paragraph', 'content': 'Consider implementing file system monitoring to detect unauthorized file writes outside expected directories.'}] [1, 2]

Useful 0 Not Useful 0