CVE-2026-25731 Overview
CVE-2026-25731 is a Server-Side Template Injection (SSTI) vulnerability discovered in Calibre, a widely-used open-source e-book management application. Prior to version 9.2.0, the vulnerability exists in Calibre's Templite templating engine, allowing arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template-html or --template-html-index command-line options.
Critical Impact
This vulnerability enables attackers to execute arbitrary code on victim systems by crafting malicious template files, potentially leading to complete system compromise when users process untrusted ebook conversion templates.
Affected Products
- Calibre e-book manager versions prior to 9.2.0
- Systems using Calibre's Templite templating engine for HTML conversion
- Users utilizing custom template files with --template-html or --template-html-index options
Discovery Timeline
- 2026-02-06 - CVE-2026-25731 published to NVD
- 2026-02-06 - Last updated in NVD database
Technical Details for CVE-2026-25731
Vulnerability Analysis
This Server-Side Template Injection vulnerability affects the Templite templating engine used by Calibre for HTML templating during ebook conversions. The vulnerability arises because the Templite engine processes user-controlled template content without adequate sandboxing or input validation, allowing malicious template expressions to execute arbitrary Python code in the context of the Calibre application.
The attack requires local access and user interaction—specifically, a user must be tricked into using a malicious template file when converting ebooks. Despite these requirements, successful exploitation can result in complete compromise of confidentiality, integrity, and availability on the affected system.
Root Cause
The root cause is the use of the Templite templating engine, which lacked sufficient security controls to prevent code execution through template expressions. Templite allows embedded Python code execution within templates, which becomes dangerous when processing untrusted template files provided by users or sourced from external locations.
The vulnerability is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), indicating that template expressions were not properly sanitized before processing.
Attack Vector
The attack vector requires local access with no privileges but requires user interaction. An attacker would craft a malicious template file containing embedded code and convince a victim to use this template when converting an ebook. The attack could be delivered through:
- Distributing malicious template files disguised as legitimate ebook conversion templates
- Embedding malicious templates within ebook packages shared on forums or file-sharing platforms
- Social engineering users to download and use "enhanced" template files
The security patch addressed this vulnerability by replacing the Templite templating engine with Pystache, a logic-less templating library that does not support arbitrary code execution:
"xxhash == 3.6.0",
"tzdata == 2025.2",
"tzlocal == 5.3.1",
+ "pystache == 0.6.8",
]
[project.urls]
Source: GitHub Commit
The patch also removed the Templite dependency entirely:
Copyright: Various
License: BSD
-Files: src/templite/*
-Copyright: Copyright (c) 2009 joonis new media, Thimo Kraemer
-License: GPL-2+
- The full text of the GPL is distributed as in
- /usr/share/common-licenses/GPL-2 on Debian systems.
-
Files: src/calibre/devices/bambook/*
Copyright: 2010, Li Fanxi
License: GPL-3
Source: GitHub Commit
Detection Methods for CVE-2026-25731
Indicators of Compromise
- Unexpected process spawning from Calibre application during ebook conversion operations
- Unusual network connections originating from the Calibre process
- Suspicious template files (.html, .xhtml) containing embedded Python code or template injection payloads
- Command-line invocations of Calibre using --template-html or --template-html-index with non-standard template sources
Detection Strategies
- Monitor process creation events for child processes spawned by Calibre during conversion operations
- Implement file integrity monitoring on template directories used by Calibre
- Analyze command-line arguments for Calibre executions, particularly those referencing external template files
- Deploy endpoint detection rules to identify template injection patterns in files processed by Calibre
Monitoring Recommendations
- Enable audit logging for Calibre application execution and file access patterns
- Implement application control policies to restrict Calibre from executing system commands
- Monitor for anomalous Python code execution patterns within the Calibre process context
- Track downloads and file modifications in directories commonly used for ebook templates
How to Mitigate CVE-2026-25731
Immediate Actions Required
- Upgrade Calibre to version 9.2.0 or later immediately
- Audit existing template files used in ebook conversion workflows for suspicious content
- Avoid using custom templates from untrusted sources until the patch is applied
- Review recent ebook conversion activities for any anomalous behavior
Patch Information
The vulnerability has been fixed in Calibre version 9.2.0. The fix replaces the vulnerable Templite templating engine with Pystache, a logic-less templating library that prevents arbitrary code execution. The security patch is available via:
Workarounds
- Disable or restrict use of custom HTML templates until upgrade is complete
- Implement strict file validation for any template files before use
- Run Calibre in a sandboxed environment or container to limit potential impact of exploitation
- Apply application whitelisting to prevent Calibre from executing unauthorized code
# Verify Calibre version to ensure patch is applied
calibre --version
# Expected output should show version 9.2.0 or higher
# If using package manager (example for Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade calibre
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
