Server-Side Request Forgery in calibreweb

CRITICAL 9.9CVE-2022-0767 · GHSA-h65g-jfqg-2w6m · PYSEC-2026-306 · Published 07/03/2022 · updated 17/06/2026

In short

CVE-2022-0767 is a CRITICAL (CVSS 9.9) vulnerability affecting calibreweb, calibre-web (janeczku).
Chance of exploitation in the next 30 days (EPSS): 0.98%, higher than 62.4% of all vulnerabilities.
Fix: update to 0.6.17 or later.

Package	Affected versions	Patched versions
calibreweb PyPI	`< 0.6.17`	`0.6.17`
calibre-web janeczku	`< 0.6.17`	`0.6.17`

Description

calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to localhost.

NVD description

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

References

nvd.nist.gov/vuln/detail/CVE-2022-0767 · ADVISORY
janeczku/calibre-web commit 965352c · WEB
janeczku/calibre-web · PACKAGE
pypa/advisory-database · WEB
huntr.dev/bounties/b26fc127-9b6a-4be7-a455-58aefbb62d9e · WEB
pypi.org/project/calibreweb · WEB
GitHub Advisory GHSA-h65g-jfqg-2w6m · ADVISORY

More vulnerabilities in calibreweb

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

calibreweb

PyPI

< 0.6.17

0.6.17

calibre-web

janeczku

< 0.6.17

0.6.17

Description

NVD description

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

More vulnerabilities in calibreweb

See all →