CyberSecBulletin

Calibre Web vulnerabilities

We track 2 vulnerabilities in Calibre Web products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 24, 2025.

2vulnerabilities
1critical
1high
0exploited
9.3average CVSS score

Latest Calibre Web vulnerabilities

  • 9.8 Critical severity

    Calibre Web: Improper Neutralization of Special Elements used in an OS Command

    CVE-2025-7404Calibre WebEPSS 2.76%

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

  • 8.7 High severity

    Calibre Web: Inefficient Regular Expression Complexity

    CVE-2025-6998Calibre Web

    ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This