CVE-2025-7404: Calibre Web OS Command Injection Vulnerability
Summary
CVE-2025-7404: Calibre Web and Autocaliweb have OS Command Injection vulnerability. Affects calibreweb versions < 0.6.24. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Calibre Web is an open-source web application that allows users to manage and access their eBook library through a web interface. It provides features such as book organization, user management, and support for various eBook formats. The application is widely used for its ease of use and flexibility. However, it has been identified to have a vulnerability that could allow attackers to execute arbitrary OS commands, posing a significant security risk.
Vulnerability Detail
The vulnerability identified as CVE-2025-7404 is an OS Command Injection issue found in Calibre Web and Autocaliweb. This flaw arises from improper neutralization of special elements used in OS commands, allowing for blind OS command injection. Attackers could exploit this vulnerability to execute arbitrary commands on the server, potentially leading to unauthorized access, data breaches, or system compromise. The affected versions of Calibre Web are up to 0.6.24, and Autocaliweb versions from 0.7.0 before 0.7.1 are also impacted.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the application or implement network-level security measures to limit exposure to potential attackers until an update can be applied.
Conclusion
CVE-2025-7404 represents a significant security risk for users of Calibre Web and Autocaliweb due to its OS command injection vulnerability. It is crucial for users to update their applications to the latest versions to mitigate this risk and ensure the security of their systems.
See every vulnerability recorded for calibreweb →
FAQ
CVE-2025-7404 is a vulnerability in Calibre Web that allows for OS command injection, enabling attackers to execute arbitrary commands on the server.
Calibre Web versions up to 0.6.24 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update immediately, consider implementing network-level security measures to restrict access to the application as a temporary workaround.
More information can be found in the advisory database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-qc4j-v7h6-xr5h/GHSA-qc4j-v7h6-xr5h.json.
Related vulnerabilities
Recent vulnerabilities recorded for calibreweb.
