From: Kovid Goyal <kovid@kovidgoyal.net>
Date: Thu, 12 Feb 2026 10:15:57 +0530
Subject: CVE-2026-26064: ODT Input: Ensure images are extracted within
 container

Forwarded: not-needed
Bug: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-72ch-3hqc-pgmp
Origin: https://github.com/kovidgoyal/calibre/commit/e1b5f9b45a5e8fa96c136963ad9a1d35e6adac62

Signed-off-by: YOKOTA Hiroshi <yokota.hgml@gmail.com>
---
 src/calibre/ebooks/odt/input.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/calibre/ebooks/odt/input.py b/src/calibre/ebooks/odt/input.py
index b90045e..6dc736b 100644
--- a/src/calibre/ebooks/odt/input.py
+++ b/src/calibre/ebooks/odt/input.py
@@ -27,10 +27,16 @@ class Extract(ODF2XHTML):
     def extract_pictures(self, zf):
         if not os.path.exists('Pictures'):
             os.makedirs('Pictures')
+        base = os.path.abspath(os.getcwd())
+        if not base.endswith(os.sep):
+            base += os.sep
         for name in zf.namelist():
             if name.startswith('Pictures') and name not in {'Pictures', 'Pictures/'}:
+                dest = os.path.abspath(os.path.join(base, name))
+                if os.path.commonprefix([base, dest]) != dest:
+                    continue
                 data = zf.read(name)
-                with open(name, 'wb') as f:
+                with open(dest, 'wb') as f:
                     f.write(data)
 
     def apply_list_starts(self, root, log):
