Calibre <= 7.14.0 Remote Code Execution

Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0. id: CVE-2024-6782 info: name: Calibre = 7.14.0 Remote Code Execution author: DhiyaneshDK severity: critical description: | Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0...

Calibre <= 7.14.0 Arbitrary File Read

Arbitrary file read via Calibre’s content server in Calibre = 7.14.0. id: CVE-2024-6781 info: name: Calibre = 7.14.0 Arbitrary File Read author: DhiyaneshDK severity: high description: | Arbitrary file read via Calibre’s content server in Calibre = 7.14.0. impact: | Attackers can exploit the...

Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS)

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

CVE-2026-73248

A flaw was found in calibre, an e-book manager. A remote attacker could craft a malicious e-book file such as EPUB, OPF, or PDF containing specially crafted metadata. When a user opens or imports this file, the application's processing of nested templates can bypass Python template restrictions,...

CVE-2026-73249

A flaw was found in the calibre Content Server. This vulnerability allows a remote attacker, including unauthenticated users, to bypass authorization checks when interacting with the /book-update-annotations endpoint. By sending specially crafted JSON data, an attacker can modify book annotations...

Linux Distros Unpatched Vulnerability : CVE-2026-73249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update- annotations/libraryid/bookid/fmt in src/calibre/srv/books....

Linux Distros Unpatched Vulnerability : CVE-2026-73248

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file...

CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

CVE-2026-73248

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

DEBIAN-CVE-2026-73248

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

DEBIAN-CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

UBUNTU-CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

CVE-2026-73248

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

UBUNTU-CVE-2026-73248

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

EUVD-2026-57015

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

CVE-2026-73249 calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

CVE-2026-73249

Summary: Calibre Content Server before 9.12.0 allows unauthorized annotation changes via POST /book-update-annotations/{library_id}/{book_id}/{fmt} due to omitting needs_db_write=True in src/calibre/srv/books.py. This prevents Router.dispatch() from invoking ctx.check_for_write_access() before up...

CVE-2026-73249 calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...