CVE-2022-0767: Server-Side Request Forgery in calibreweb
Summary
CVE-2022-0767: Server-Side Request Forgery in calibreweb. Affects calibreweb versions < 0.6.17. Fixed in 0.6.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
calibreweb is a Python package available on PyPI that provides a web interface for managing and accessing an ebook library. It allows users to browse, search, and download ebooks stored in the library. The package is widely used by individuals and organizations to organize and share their ebook collections. However, a vulnerability has been discovered in calibreweb versions prior to 0.6.17 that exposes the application to server-side request forgery (SSRF) attacks.
Vulnerability Detail
The SSRF vulnerability in calibreweb arises from incomplete protection against SSRF attacks, which can be bypassed through an HTTP redirect. An attacker can exploit this vulnerability by sending a specially crafted request to the application, tricking it into making unintended requests to internal resources or external systems. In the case of calibreweb, an HTTP server configured to respond with a 302 redirect can redirect a request to localhost, potentially exposing sensitive information or allowing unauthorized access to internal resources.
How To Fix
Latest published version: 0.6.27 as of 22 Oct 2026
pip install --upgrade "calibreweb==0.6.27"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.17
This is the first release that contains the fix.
pip install --upgrade "calibreweb==0.6.17"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the latest version of calibreweb to ensure the application is protected against SSRF attacks.
Conclusion
calibreweb versions prior to 0.6.17 are vulnerable to server-side request forgery (SSRF) attacks. This vulnerability can be exploited to access sensitive information or perform unauthorized actions. Users should update their calibreweb installations to version 0.6.17 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for calibreweb →
FAQ
calibreweb is a Python package that provides a web interface for managing and accessing an ebook library. It allows users to browse, search, and download ebooks stored in the library.
Server-side request forgery (SSRF) is a vulnerability that allows an attacker to make requests to internal resources or external systems on behalf of the vulnerable application. In the case of calibreweb, an attacker can exploit SSRF to access sensitive information or perform unauthorized actions.
The SSRF vulnerability in calibreweb can be exploited by sending a specially crafted request to the application, tricking it into making unintended requests to internal resources or external systems. An attacker can use this to access sensitive information or perform unauthorized actions.
Yes, the developers of calibreweb have released version 0.6.17, which addresses the SSRF vulnerability. Users are advised to update their installations to this version or later to mitigate the risk of exploitation.
No, there are no known workarounds for this vulnerability. It is crucial to update to the latest version of calibreweb to ensure protection against SSRF attacks.
Related vulnerabilities
Recent vulnerabilities recorded for calibreweb.
