PatchTheCVEcalibre-web vulnerabilities and fixes
Recent CVEs affecting calibre-web, with upgrade or downgrade steps. 6 tracked.
Also searched as: calibre web.
calibre-web has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2025-12-02. Highest priority: CVE-2025-7404 (score 66/100).
- CVE-2025-7404 CRITICAL 9.8 DOWNGRADE DOWNGRADE Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ca
- CVE-2025-65858 LOW 3.5 DOWNGRADE A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious
- CVE-2024-39123 MEDIUM 5.4 UPGRADE In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting
- CVE-2021-3988 MEDIUM 6.1 UPGRADE A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_book
- CVE-2021-3987 MEDIUM 4.3 UPGRADE An improper access control vulnerability exists in janeczku/calibre-web
- CVE-2021-3986 MEDIUM 4.3 UPGRADE A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belongi
FAQ
How do I fix calibre-web vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is calibre-web being exploited right now?
None of the tracked calibre-web CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which calibre-web CVE should I patch first?
CVE-2025-7404 currently ranks highest (66/100): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ca.