CVE-2026-25731: Calibre E-Book Manager RCE Vulnerability

CVE-2026-25731 Overview

CVE-2026-25731 is a Server-Side Template Injection (SSTI) vulnerability discovered in Calibre, a widely-used open-source e-book management application. Prior to version 9.2.0, the vulnerability exists in Calibre's Templite templating engine, allowing arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template-html or --template-html-index command-line options.

Critical Impact
This vulnerability enables attackers to execute arbitrary code on victim systems by crafting malicious template files, potentially leading to complete system compromise when users process untrusted ebook conversion templates.

Affected Products

Calibre e-book manager versions prior to 9.2.0
Systems using Calibre's Templite templating engine for HTML conversion
Users utilizing custom template files with --template-html or --template-html-index options

Discovery Timeline

2026-02-06 - CVE-2026-25731 published to NVD
2026-02-06 - Last updated in NVD database

Technical Details for CVE-2026-25731

Vulnerability Analysis

This Server-Side Template Injection vulnerability affects the Templite templating engine used by Calibre for HTML templating during ebook conversions. The vulnerability arises because the Templite engine processes user-controlled template content without adequate sandboxing or input validation, allowing malicious template expressions to execute arbitrary Python code in the context of the Calibre application.

The attack requires local access and user interaction—specifically, a user must be tricked into using a malicious template file when converting ebooks. Despite these requirements, successful exploitation can result in complete compromise of confidentiality, integrity, and availability on the affected system.

Root Cause

The root cause is the use of the Templite templating engine, which lacked sufficient security controls to prevent code execution through template expressions. Templite allows embedded Python code execution within templates, which becomes dangerous when processing untrusted template files provided by users or sourced from external locations.

The vulnerability is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), indicating that template expressions were not properly sanitized before processing.

Attack Vector

The attack vector requires local access with no privileges but requires user interaction. An attacker would craft a malicious template file containing embedded code and convince a victim to use this template when converting an ebook. The attack could be delivered through:

Distributing malicious template files disguised as legitimate ebook conversion templates
Embedding malicious templates within ebook packages shared on forums or file-sharing platforms
Social engineering users to download and use "enhanced" template files

The security patch addressed this vulnerability by replacing the Templite templating engine with Pystache, a logic-less templating library that does not support arbitrary code execution:

text

 	"xxhash == 3.6.0",
     "tzdata == 2025.2",
     "tzlocal == 5.3.1",
+	"pystache == 0.6.8",
 ]
 
 [project.urls]

Source: GitHub Commit

The patch also removed the Templite dependency entirely:

text

 Copyright: Various
 License: BSD
 
-Files: src/templite/*
-Copyright: Copyright (c) 2009 joonis new media, Thimo Kraemer
-License: GPL-2+
- The full text of the GPL is distributed as in
- /usr/share/common-licenses/GPL-2 on Debian systems.
-
 Files: src/calibre/devices/bambook/*
 Copyright: 2010, Li Fanxi
 License: GPL-3

Source: GitHub Commit

Detection Methods for CVE-2026-25731

Indicators of Compromise

Unexpected process spawning from Calibre application during ebook conversion operations
Unusual network connections originating from the Calibre process
Suspicious template files (.html, .xhtml) containing embedded Python code or template injection payloads
Command-line invocations of Calibre using --template-html or --template-html-index with non-standard template sources

Detection Strategies

Monitor process creation events for child processes spawned by Calibre during conversion operations
Implement file integrity monitoring on template directories used by Calibre
Analyze command-line arguments for Calibre executions, particularly those referencing external template files
Deploy endpoint detection rules to identify template injection patterns in files processed by Calibre

Monitoring Recommendations

Enable audit logging for Calibre application execution and file access patterns
Implement application control policies to restrict Calibre from executing system commands
Monitor for anomalous Python code execution patterns within the Calibre process context
Track downloads and file modifications in directories commonly used for ebook templates

How to Mitigate CVE-2026-25731

Immediate Actions Required

Upgrade Calibre to version 9.2.0 or later immediately
Audit existing template files used in ebook conversion workflows for suspicious content
Avoid using custom templates from untrusted sources until the patch is applied
Review recent ebook conversion activities for any anomalous behavior

Patch Information

The vulnerability has been fixed in Calibre version 9.2.0. The fix replaces the vulnerable Templite templating engine with Pystache, a logic-less templating library that prevents arbitrary code execution. The security patch is available via:

Workarounds

Disable or restrict use of custom HTML templates until upgrade is complete
Implement strict file validation for any template files before use
Run Calibre in a sandboxed environment or container to limit potential impact of exploitation
Apply application whitelisting to prevent Calibre from executing unauthorized code

bash

# Verify Calibre version to ensure patch is applied
calibre --version
# Expected output should show version 9.2.0 or higher

# If using package manager (example for Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade calibre