Calibre Web and Autocaliweb have OS Command Injection vulnerability

CRITICAL 9.8CVE-2025-7404 · GHSA-qc4j-v7h6-xr5h · PYSEC-2026-1235 · Published 24/07/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
calibreweb PyPI	`≤ 0.6.24`	No fix yet
autocaliweb gelbphoenix	`= 0.7.0`	No fix yet
calibre-web janeczku	`= 0.6.24`	No fix yet

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

NVD description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

References

nvd.nist.gov/vuln/detail/CVE-2025-7404 · ADVISORY
fluidattacks.com/advisories/kino · WEB
gelbphoenix/autocaliweb · WEB
janeczku/calibre-web · WEB
pypi.org/project/calibreweb · PACKAGE
GitHub Advisory GHSA-qc4j-v7h6-xr5h · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free