A path traversal vulnerability in the calibre e-book manager allows unauthenticated attackers to achieve remote code execution on Windows systems by writing malicious payloads to the startup directory.

This is a path traversal vulnerability (CWE-22) triggered by the extract_pictures function, which fails to sanitize directory traversal sequences. The vulnerability allows an attacker to write files to arbitrary locations, which can lead to remote code execution on Windows if a payload is placed in the user startup folder.

The potential for remote code execution poses a severe risk to organizational security, as it allows for full system compromise, data exfiltration, or the installation of persistent malware. With a CVSS score of 8.8, this flaw is categorized as High, reflecting the significant impact on confidentiality, integrity, and availability. Successful exploitation could lead to unauthorized access to sensitive e-book libraries and the underlying host operating system.

Immediate Action: Update the calibre installation to version 9.3.0 or later to ensure the extract_pictures function properly sanitizes file paths.

Proactive Monitoring: Monitor system logs for unauthorized file write attempts, specifically looking for unexpected file creation events within the Windows Startup directory or other sensitive system folders.

Compensating Controls: Ensure that users run the application with the principle of least privilege, minimizing the permissions available to the process and reducing the potential impact if a file write is attempted.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability represents a significant security risk. Administrators and users should prioritize updating to version 9.3.0 immediately to mitigate the threat of arbitrary file writes and potential system compromise.