CVE-2026-25731

calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template-html or --template-html-index command-line options. This vulnerability is fixed in 9.2.0.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.24% chance of exploitation in the next 30 days, 15th percentile

Published

2026-02-06

Proof-of-concept exploits (1)

• dxlerYT/CVE-2026-257315★ · 2026-02-07

References

• CVE Record
• NVD entry

Related

• CVE-2024-41570
• CVE-2026-26331
• CVE-2026-25676
• CVE-2026-25732
• CVE-2026-2567
• CVE-2026-25746