calibreweb is vulnerable to server-side request forgery. The vulnerability exists in _delete_user
function of admin.py
due to lack of validation which allows an attacker to fetch localhost URL and upload a book cover.
Vendor | Product | Version | CPE |
---|---|---|---|
* | calibreweb | * | cpe:2.3:a:*:calibreweb:*:*:*:*:*:*:*:* |