CVE-2026-73248
Description
A flaw was found in calibre, an e-book manager. A remote attacker could craft a malicious e-book file (such as EPUB, OPF, or PDF) containing specially crafted metadata. When a user opens or imports this file, the application's processing of nested templates can bypass Python template restrictions, leading to the execution of arbitrary Python code. This vulnerability results in remote code execution.
Statement
This vulnerability is rated as Important severity because successful exploitation permits arbitrary code execution in the context of the user opening the document. The risk is constrained by the necessity of user interaction to import or view a specially crafted e-book file. Additionally, Calibre is not shipped or supported in Red Hat Enterprise Linux, limiting the overall impact to community distributions such as Fedora.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
