CVE-2022-30765: SQL injection in calibreweb
Summary
CVE-2022-30765: SQL injection in calibreweb. Affects calibreweb versions < 0.6.18. Fixed in 0.6.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Calibre-Web is an open-source web application that provides a user-friendly interface for managing and accessing e-book libraries. It allows users to browse, search, and download e-books from their Calibre library. The vulnerability identified as CVE-2022-30765 affects Calibre-Web versions prior to 0.6.18. This vulnerability allows an attacker to perform SQL injection attacks on the user table, potentially leading to unauthorized access, data manipulation, or data leakage.
Vulnerability Detail
The SQL injection vulnerability in Calibre-Web arises due to insufficient input validation and sanitization. By crafting malicious input, an attacker can manipulate the SQL queries executed by the application, bypassing intended access controls and injecting arbitrary SQL code. This can result in the execution of unintended SQL commands, such as SELECT, INSERT, UPDATE, or DELETE, leading to unauthorized access to sensitive data, modification of data, or even the complete compromise of the underlying database. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 0.6.27 as of 22 Oct 2026
pip install --upgrade "calibreweb==0.6.27"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.18
This is the first release that contains the fix.
pip install --upgrade "calibreweb==0.6.18"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to implement input validation and sanitization mechanisms to prevent the injection of malicious SQL code. This can be achieved by using parameterized queries or prepared statements when interacting with the database. Additionally, enforcing strict input validation on user-supplied data can help mitigate the risk of SQL injection attacks.
Conclusion
The SQL injection vulnerability in Calibre-Web (CVE-2022-30765) poses a significant risk to the confidentiality, integrity, and availability of the application and its underlying data. It is crucial to promptly upgrade to version 0.6.18 or later to mitigate this vulnerability. Implementing input validation and sanitization mechanisms can serve as a temporary workaround until the upgrade is performed. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for calibreweb →
FAQ
Calibre-Web is an open-source web application that provides a user-friendly interface for managing and accessing e-book libraries. It allows users to browse, search, and download e-books from their Calibre library.
SQL injection is a web application vulnerability that allows an attacker to manipulate SQL queries executed by the application. By injecting malicious SQL code, an attacker can bypass access controls and perform unauthorized actions on the database.
The SQL injection vulnerability in Calibre-Web can lead to unauthorized access to sensitive data, data manipulation, or data leakage. An attacker could extract or modify user information, compromise the integrity of the database, or even gain full control over the underlying system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Calibre-Web installation is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including CVE-2022-30765.
For more information about the CVE-2022-30765 vulnerability, you can refer to the GitHub Advisory Database entry at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-8ppf-x4gr-2x7g/GHSA-8ppf-x4gr-2x7g.json
Related vulnerabilities
Recent vulnerabilities recorded for calibreweb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
