From: Kovid Goyal <kovid@kovidgoyal.net>
Date: Mon, 16 Mar 2026 08:37:16 +0530
Subject: CVE-2026-33206: TXT Input: Ensure resource files are read only from
 book contents

Forwarded: not-needed
Bug: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-h3p4-m74f-43g6
Origin: https://github.com/kovidgoyal/calibre/commit/c43f347837dbc00d9a7b5ff15a228b6f6081e290

Signed-off-by: YOKOTA Hiroshi <yokota.hgml@gmail.com>
---
 src/calibre/ebooks/conversion/plugins/txt_input.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/calibre/ebooks/conversion/plugins/txt_input.py b/src/calibre/ebooks/conversion/plugins/txt_input.py
index a28f58e..82cbab7 100644
--- a/src/calibre/ebooks/conversion/plugins/txt_input.py
+++ b/src/calibre/ebooks/conversion/plugins/txt_input.py
@@ -111,7 +111,7 @@ class TXTInput(InputFormatPlugin):
             src = img.get('src')
             prefix = src.split(':', 1)[0].lower()
             if src and prefix not in ('file', 'http', 'https', 'ftp') and not os.path.isabs(src):
-                src = os.path.join(base_dir, src)
+                src = os.path.abspath(os.path.join(base_dir, src))
                 if os.path.isfile(src) and os.access(src, os.R_OK):
                     with open(src, 'rb') as f:
                         data = f.read()
