What is CVE-2026-73248?
CVE-2026-73248: In calibre, an e-book manager before version 9.12.0, attacker-controlled 'composite_template' metadata in malicious EPUB, OPF, or PDF files can lead to arbitrary Python code execution due to improper handling of nested template() calls. This allows attackers to run code on affected systems. Immediately upgrade calibre to the latest version.
Azərbaycanca: CVE-2026-73248: Calibre e-kitab meneceri, 9.12.0 versiyasından əvvəl, EPUB, OPF, PDF kimi zərərli fayllarda xüsusi hazırlanmış 'composite_template' metadata vasitəsilə ixtiyari Python kodunun icrasına imkan verən boşluq aşkarlanıb. Bu, hücumçulara təsirlənən sistemdə kod işlətməyə şərait yaradır. Calibre tətbiqini dərhal ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-94
FAQ2
Which versions of the calibre application are vulnerable to CVE-2026-73248?
This vulnerability affects all versions of the calibre e-book manager prior to version 9.12.0.
How can attackers achieve code execution through CVE-2026-73248?
Attackers can achieve arbitrary Python code execution on the affected system via specially crafted 'composite_template' metadata in malicious files such as EPUB, OPF, or PDF.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.