Calibre, a widely used cross-platform e-book management application, suffered from a critical security vulnerability identified as CVE-2026-33206, classified under CWE-23 (Relative Path Traversal). This vulnerability affects versions prior to 9.6.0 and arises from improper sanitization of file paths when handling images embedded in Markdown and other text-based e-book formats. An attacker can craft malicious e-book content that references arbitrary files on the local file system, causing these files to be included in the converted e-book output. Furthermore, the vulnerability extends to the ebook reader's web view background-image endpoint, which lacks proper authentication and is susceptible to server-side request forgery (SSRF). This combination allows an attacker to exfiltrate sensitive files from the victim's system without requiring additional user interaction or authentication. The CVSS 4.0 base score of 8.2 reflects the high impact on confidentiality due to file disclosure, with low attack complexity and no privileges required, though user interaction is necessary to trigger the exploit. The vulnerability was publicly disclosed on March 27, 2026, and fixed in Calibre version 9.6.0. No public exploit code or active exploitation has been reported to date.

The primary impact of CVE-2026-33206 is unauthorized disclosure of sensitive files from the local file system of users running vulnerable Calibre versions. This can lead to leakage of confidential information, including credentials, personal data, or proprietary documents embedded within e-books. The SSRF and missing authentication in the background-image endpoint exacerbate the risk by allowing remote attackers to exfiltrate files without user interaction once the malicious content is loaded. Organizations relying on Calibre for e-book management, especially those handling sensitive or proprietary content, face risks of data breaches and privacy violations. The vulnerability could also be leveraged as a foothold for further attacks if sensitive configuration or credential files are exposed. Although exploitation requires user interaction (e.g., opening a malicious e-book), the low complexity and lack of authentication make it a significant threat, particularly in environments where users frequently exchange e-book files.

To mitigate this vulnerability, organizations and users should immediately upgrade Calibre to version 9.6.0 or later, where the issue is resolved. Until upgrading is possible, users should avoid opening e-books from untrusted or unknown sources, especially those containing Markdown or other text-based image references. Implementing endpoint security controls to detect and block suspicious file access patterns or SSRF attempts related to Calibre can reduce risk. Network segmentation and restricting Calibre's access to sensitive directories can limit potential exposure. Additionally, monitoring logs for unusual activity involving the background-image endpoint or unexpected file reads can help detect exploitation attempts. Educating users about the risks of opening unverified e-book files and enforcing strict file-sharing policies will further reduce attack surface.