CVE-2026-73248

Received Received - Intake

calibre Arbitrary Code Execution via Malicious EPUB Template

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73248

Affected Vendors & Products

Vendor	Product	Version / Range
calibre	calibre	to 9.12.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in calibre versions before 9.12.0 allows arbitrary Python code execution when processing malicious EPUB, OPF, or PDF files. Attackers can embed a crafted composite_template metadata field that uses a python: formatter, bypassing restrictions and executing code when the file is opened or imported.

Detection Guidance

This vulnerability involves malicious EPUB, OPF, or PDF files exploiting template processing in calibre versions prior to 9.12.0. Detection requires scanning files for suspicious composite_template metadata or python: template usage. Check calibre version with 'calibre --version' and inspect files with tools like 'exiftool' or 'pdfinfo' for unusual metadata. Monitor system logs for unexpected Python execution when opening files.

Impact Analysis

If exploited, this vulnerability could allow attackers to run malicious code on your system when you open a specially crafted e-book file. This could lead to unauthorized access, data theft, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance breaches if exploited.

Mitigation Strategies

Upgrade calibre to version 9.12.0 or later immediately. Avoid opening untrusted EPUB, OPF, or PDF files until updated. If upgrading is not possible, disable calibre's template processing or use a sandboxed environment to open files. Review file metadata for signs of tampering before processing.

Hi! I’m here to help you understand CVE-2026-73248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70