Summary

Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows (haven't tested on other OS's), this can lead to Remote Code Execution by writing a payload to the Startup folder, which executes on next login.

Details

Confirmed on: Calibre 9.1.0, Windows 11 (x64)
Trigger: Converting a malicious CHM file via GUI ("Convert books") or CLI (ebook-convert)

Affected Component: src/calibre/ebooks/chm/reader.py

Vulnerable Code (Line 351):

paths.append(path.lstrip('/'))

Only strips leading slash, does not sanitize .. sequences.

Vulnerable Code (Lines 185-198):

for path in self.Contents():
    fpath = path                              # ATTACKER CONTROLLED
    lpath = os.path.join(output_dir, fpath)   # PATH TRAVERSAL
    self._ensure_dir(lpath)                   # Creates dirs OUTSIDE output_dir
    data = self.GetFile(path)
    # ...
    with open(lpath, 'wb') as f:
        f.write(data)                         # ARBITRARY FILE WRITE

Attack Flow:

1. Malicious CHM contains path: /..\\..\\..\\..\\Roaming\\Microsoft\\Windows\\STARTM~1\\Programs\\Startup\\rce.bat
2. Contents() returns path with .. intact (only leading / stripped)
3. os.path.join(output_dir, path) escapes extraction directory
4. Payload written to Startup folder, executes on next login

PoC:

> python3 create_poc.py
[+] Created: poc.chm
[+] Open poc.chm in Calibre, rce.bat will be written to Startup folder
[+] Tested on Windows 11, Calibre 9.1.0

> dir "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
rce.bat    78 bytes

# Reboot → calc.exe launches automatically

Proof Files:

• create_poc.py - Standalone PoC generator

I can't upload the .chm file due to GitHub not supporting it, please feel free to run the create_poc.py.

create_poc.py