From: Kovid Goyal <kovid@kovidgoyal.net>
Date: Mon, 16 Mar 2026 08:50:19 +0530
Subject: CVE-2026-33205: E-book viewer: prevent reading background images
 from outside the config dir

Forwarded: not-needed
Bug: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-4926-v9px-wv7v
Origin: https://github.com/kovidgoyal/calibre/commit/6eb7b5458f183c8a037e9d7dac428122a77204e4

Signed-off-by: YOKOTA Hiroshi <yokota.hgml@gmail.com>
---
 src/calibre/gui2/viewer/web_view.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/calibre/gui2/viewer/web_view.py b/src/calibre/gui2/viewer/web_view.py
index fc077f1..0ea687c 100644
--- a/src/calibre/gui2/viewer/web_view.py
+++ b/src/calibre/gui2/viewer/web_view.py
@@ -80,13 +80,16 @@ def get_data(name):
 def background_image():
     ans = getattr(background_image, 'ans', None)
     if ans is None:
-        img_path = os.path.join(viewer_config_dir, 'bg-image.data')
+        base = os.path.abspath(viewer_config_dir) + os.sep
+        img_path = os.path.abspath(os.path.join(base, 'bg-image.data'))
+        if not img_path.startswith(base):
+            return 'image/jpeg', b''
         if os.path.exists(img_path):
             with open(img_path, 'rb') as f:
                 data = f.read()
                 mt, data = data.split(b'|', 1)
         else:
-            ans = b'image/jpeg', b''
+            return 'image/jpeg', b''
         ans = background_image.ans = mt.decode('utf-8'), data
     return ans
 
