A critical Server-Side Template Injection vulnerability in Calibre versions prior to 9.2.0 allows attackers to achieve arbitrary code execution on systems processing malicious ebook template files.

This is a Server-Side Template Injection (CWE-1336) vulnerability within the Templite templating engine. An unauthenticated attacker can achieve arbitrary code execution if a user is induced to process a malicious template file via the --template-html or --template-html-index command-line options.

The ability for an attacker to execute arbitrary code on a host system poses a severe risk to data integrity, confidentiality, and system availability. Given the CVSS score of 7.8, this vulnerability represents a high-severity threat that could lead to full system compromise if an attacker successfully targets a user performing ebook conversions.

Immediate Action: Update Calibre to version 9.2.0 or later immediately to incorporate the necessary security patches for the Templite engine.

Proactive Monitoring: Review system command-line execution logs for unusual arguments passed to the Calibre binary, specifically monitoring for the use of template-related flags from untrusted sources.

Compensating Controls: Restrict the ability of unauthorized users to execute the Calibre binary or provide custom template files. Ensure that users only process ebook files from trusted, verified sources to prevent the introduction of malicious templates.

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub (https://github.com/dxlerYT/CVE-2026-25731).

The presence of a public proof-of-concept repository necessitates swift action to mitigate the risk of exploitation. Administrators and individual users should prioritize updating to Calibre 9.2.0, as this version contains the upstream fixes required to neutralize the template injection flaw. Failure to patch leaves the system vulnerable to arbitrary code execution by any actor capable of providing a malicious template file.