Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2026-0156

NIXPKGS-2026-0156
published on 7 Feb 2026
Permalink CVE-2026-25635
8.6 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
updated 1 month, 3 weeks ago by @LeSuisse Activity log
  • Created automatic suggestion 1 month, 3 weeks ago
  • @LeSuisse removed
    4 packages
    • calibre-web
    • pkgsRocm.calibre
    • calibre-no-speech
    • pkgsRocm.calibre-no-speech
    1 month, 3 weeks ago
  • @LeSuisse accepted 1 month, 3 weeks ago
  • @LeSuisse published on GitHub 1 month, 3 weeks ago
calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution

calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows (haven't tested on other OS's), this can lead to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. This vulnerability is fixed in 9.2.0.

References

Affected products

calibre
  • ==< 9.2.0

Matching in nixpkgs

Package maintainers

Upstream advisory: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-32vh-whvh-9fxr
Upstream patch: https://github.com/kovidgoyal/calibre/commit/9739232fcb029ac15dfe52ccd4fdb4a07ebb6ce9