A path traversal vulnerability in Calibre versions 9.1.0 and earlier enables local file corruption, potentially leading to system instability or unauthorized data modification.

The application is susceptible to a path traversal flaw (CWE-22) originating from the improper handling of CipherReference URIs within the EPUB conversion module. An attacker can craft a malicious EPUB file that forces the Calibre process to write to arbitrary locations on the filesystem.

The ability to corrupt arbitrary files poses a significant risk to system integrity and data availability. Because the vulnerability allows the application to overwrite files accessible to the Calibre process, a successful exploit could result in the destruction of critical configuration files or system data. With a CVSS score of 8.2, this vulnerability is categorized as high severity and requires immediate attention to prevent potential service disruption or unauthorized file manipulation.

Immediate Action: Update the Calibre installation to version 9.2.0 or later to apply the necessary path validation fixes.

Proactive Monitoring: Review system logs for unusual file access patterns or error messages generated during EPUB conversion tasks.

Compensating Controls: Avoid opening EPUB files from untrusted or unknown sources until the software has been patched.

Public Exploit Available: Unknown

Given the high severity of this path traversal flaw, organizations utilizing Calibre must prioritize the update to version 9.2.0. Failure to patch allows for the potential corruption of sensitive data, which could lead to operational downtime or loss of system integrity. Apply the provided vendor update immediately to mitigate this exposure.