The calibre e-book manager contains a high-severity path traversal vulnerability that can be leveraged by an attacker to achieve remote code execution on Windows systems.

The vulnerability is a path traversal flaw (CWE-22) located within the application's CHM file reader. An unauthenticated attacker can exploit this by crafting a malicious CHM file that, when opened, allows arbitrary file writes in locations accessible to the user, such as the Windows Startup folder.

Successful exploitation poses a significant risk to organizational endpoints, particularly those running Windows. By writing malicious payloads into the Startup folder, an attacker can achieve persistent remote code execution upon the next user login, potentially resulting in full system compromise, unauthorized data access, and lateral movement within the network. With a CVSS score of 8.6, this vulnerability represents a serious threat to confidentiality, integrity, and availability.

Immediate Action: Update the calibre application to version 9.2.0 or later immediately to resolve the vulnerable CHM parsing logic.

Proactive Monitoring: Review system logs for unauthorized file creation attempts in sensitive directories, such as the Windows Startup folder (e.g., C:\Users<Username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup).

Compensating Controls: Restrict the ability of users to open untrusted or externally sourced CHM files, and ensure that endpoint protection software is configured to detect and block unauthorized modification of system startup locations.

Public Exploit Available: No.

Given the potential for remote code execution, this vulnerability should be prioritized for remediation across all managed environments using calibre. Administrators must ensure that all instances are updated to version 9.2.0 or later to neutralize the path traversal risk. In the interim, enforce strict policies regarding the handling of untrusted e-book files to prevent the delivery of malicious payloads.