calibre-web is vulnerable to Business Logic Errors

CRITICAL 9.8CVE-2021-4171 · GHSA-xp7p-3gx7-j6wx · PYSEC-2026-307 · Published 17/01/2022 · updated 17/06/2026

In short

CVE-2021-4171 is a CRITICAL (CVSS 9.8) vulnerability affecting calibreweb, calibre-web (janeczku).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.3% of all vulnerabilities.
Fix: update to 0.6.15 or later.

Package	Affected versions	Patched versions
calibreweb PyPI	`< 0.6.15`	`0.6.15`
calibre-web janeczku	`< 0.6.15`	`0.6.15`

NVD description

calibre-web is vulnerable to Business Logic Errors

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

< 0.6.15

0.6.15

< 0.6.15

0.6.15

More vulnerabilities in calibreweb

See all →