---
id: "CVE-2021-4171"
kind: "vulnerability"
aliases: ["CVE-2021-4171", "GHSA-xp7p-3gx7-j6wx"]
title: "calibre-web is vulnerable to Business Logic Errors"
severity: "critical"
cvss: 9.8
epss: 0.01387
exploited: false
status: "open"
category: "package"
products: [{"name": "calibreweb", "fixed": ["0.6.15"], "affected": "< 0.6.15", "ecosystem": "pypi"}, {"name": "janeczku calibre-web", "fixed": ["0.6.15"], "affected": "< 0.6.15", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["calibre-web", "package", "python", "self-hosted"]
not_affected_if: ["version-0.6.15-or-later"]
published_at: "2022-01-17T10:15:07+00:00"
first_seen_at: "2026-10-27T16:20:27+00:00"
updated_at: "2026-10-27T16:33:07+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-xp7p-3gx7-j6wx", "first_seen_at": "2026-10-27T16:20:27+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4171", "first_seen_at": "2026-10-27T16:33:07+00:00"}]
---

# calibre-web is vulnerable to Business Logic Errors

calibre-web, a web front end for the Calibre ebook library, contains business logic errors that the advisory rates critical (CVSS 9.8). The sources do not state the exact exploit path, so the consequence is only known as a serious access or logic bypass.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:calibreweb affected < 0.6.15 fixed 0.6.15
- vendor:janeczku calibre-web affected < 0.6.15 fixed 0.6.15

## How to check

- Run `pip show calibreweb` and confirm the installed version is below `0.6.15`
- unknown for any other check, since the sources do not describe the affected feature

## Fix

- Upgrade the pypi package `calibreweb` to `0.6.15` or later

## Timeline

- 2026-10-27T16:20:27+00:00 ghsa https://github.com/advisories/GHSA-xp7p-3gx7-j6wx
- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-4171

## From the sources

calibre-web is vulnerable to Business Logic Errors

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_