CVE-2022-30765: SQL Injection Vulnerability in Calibre-Web
Summary
CVE-2022-30765: SQL injection in calibreweb. Affects calibreweb versions < 0.6.18. Fixed in 0.6.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Calibre-Web is an open-source web application that allows users to manage and access their eBook library. It provides a user-friendly interface for browsing, searching, and reading eBooks stored in a Calibre library. The application is designed to be lightweight and easy to deploy, making it popular among users who want to access their eBooks remotely. However, prior to version 0.6.18, Calibre-Web was susceptible to a SQL injection vulnerability that could compromise the security of user data.
Vulnerability Detail
The vulnerability arises from improper handling of user input in SQL queries within Calibre-Web. Specifically, the application allows attackers to manipulate SQL queries by injecting malicious SQL code through the user table. This can lead to unauthorized access to sensitive data, including user credentials and personal information. The ramifications of this vulnerability are severe, as it could allow attackers to execute arbitrary SQL commands, potentially leading to data breaches or complete system compromise.
How To Fix
Latest published version: 0.6.27 as of 22 Oct 2026
pip install --upgrade "calibreweb==0.6.27"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.18
This is the first release that contains the fix.
pip install --upgrade "calibreweb==0.6.18"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Calibre-Web application by implementing network-level security measures, such as firewalls or VPNs, to limit exposure to potential attackers. However, this is not a substitute for updating the software.
Conclusion
The SQL injection vulnerability in Calibre-Web (CVE-2022-30765) poses a significant risk to user data and application integrity. Users are strongly advised to update to version 0.6.18 or later to mitigate this risk. Implementing security measures and utilizing tools like Vulert can further enhance your application's security posture.
See every vulnerability recorded for calibreweb →
FAQ
SQL injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It can lead to unauthorized access to sensitive data.
If you are using a version prior to 0.6.18, your installation is vulnerable. You can check your version by running 'pip show calibreweb' in your terminal.
If an immediate update is not possible, consider implementing network security measures to limit access to the application until you can apply the patch.
You can find detailed information about this vulnerability in the official advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/calibreweb/PYSEC-2026-305.yaml.
Vulert uses Pipfile.lock to monitor and alert in real-time for open-source vulnerabilities in your software, providing an easy way to stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for calibreweb.
