Live › vulnerability › CVE-2021-4171
Go to dashboardcalibre-web, a web front end for the Calibre ebook library, contains business logic errors that the advisory rates critical (CVSS 9.8). The sources do not state the exact exploit path, so the consequence is only known as a serious access or logic bypass.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:20 UTC, 0h before NVD. All times on this page are UTC.
Deployments of calibre-web installed from PyPI at a version below 0.6.15 are affected. The sources do not say which feature or configuration triggers the business logic error, so whether a given instance is exposed is unknown. Instances already on 0.6.15 or later are not affected by this advisory.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| calibreweb | pypi | < 0.6.15 | 0.6.15 |
| janeczku calibre-web | vendor | < 0.6.15 | 0.6.15 |
pip show calibreweb and confirm the installed version is below 0.6.15calibreweb to 0.6.15 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
calibre-web is vulnerable to Business Logic Errors
This page as .md · .json · in your agent: get_signal("CVE-2021-4171")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.