CVE-2026-33205CWE-918

calibre has Server-Side Request Forgery in ebook viewer backend

Medium · published March 27, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
6.3
In the wild
Unconfirmed
What it is

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Server-Side Request Forgery vulnerability in the background-image endpoint of calibre e-book reader's web view allows an attacker to perform blind GET requests to arbitrary URLs and exfiltrate information out from the ebook sandbox. Version 9.6.0 patches the issue.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00172 · 6.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-03-27T13:52Z
EPSS history
Timeline
  • 27 MAR 13:52Z
    calibre has Server-Side Request Forgery in ebook viewer backend
    cvelistv5