CVE-2022-0766: Server-Side Request Forgery in calibreweb
Summary
CVE-2022-0766: Server-Side Request Forgery in calibreweb. Affects calibreweb versions < 0.6.17. Fixed in 0.6.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
calibreweb is an open-source web application that allows users to manage and serve their eBook library. It provides a user-friendly interface for accessing and organizing eBooks, making it a popular choice among digital library enthusiasts. However, prior to version 0.6.17, calibreweb is vulnerable to a server-side request forgery (SSRF) attack, which can lead to unauthorized access to internal resources.
Vulnerability Detail
The vulnerability arises from an incomplete fix for a previous issue (CVE-2022-0339). Specifically, the blacklist implemented to prevent SSRF does not adequately check for the IP address '0.0.0.0'. This oversight allows an attacker to craft a payload that resolves '0.0.0.0' to 'localhost', potentially exposing sensitive internal services to unauthorized access. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Latest published version: 0.6.27 as of 22 Oct 2026
pip install --upgrade "calibreweb==0.6.27"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.17
This is the first release that contains the fix.
pip install --upgrade "calibreweb==0.6.17"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional network security measures, such as firewalls or access controls, to restrict access to internal resources until the package is updated. However, this is not a substitute for applying the official patch.
Conclusion
The SSRF vulnerability in calibreweb prior to version 0.6.17 poses a significant risk to users by allowing unauthorized access to internal resources. It is crucial to update to the latest version to protect against potential exploits. Users are encouraged to monitor their applications using tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for calibreweb →
FAQ
SSRF is a type of attack where an attacker can send crafted requests from the server to internal or external resources, potentially leading to unauthorized access or data leakage.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to access sensitive internal services, leading to data breaches or further exploitation of the network.
Yes, implementing strict network access controls and monitoring can help mitigate the risk until you can apply the update.
You can find more information about calibreweb on its official GitHub repository or documentation site.
Related vulnerabilities
Recent vulnerabilities recorded for calibreweb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
