Live › vulnerability › CVE-2022-0766
Go to dashboardcalibreweb before 0.6.17 has an incomplete fix for an earlier SSRF bug: its blocklist does not catch 0.0.0.0, which resolves to localhost. An attacker can make the server send requests to internal services on its own machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:13 UTC, 0h before NVD. All times on this page are UTC.
Instances running calibreweb below 0.6.17 that expose features which fetch remote URLs are exposed, because the SSRF blocklist was incomplete. Installs at 0.6.17 or later are not affected. The sources do not say whether authentication is required to reach the vulnerable feature.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| calibreweb | pypi | < 0.6.17 | 0.6.17 |
| janeczku calibre-web | vendor | < 0.6.17 | 0.6.17 |
pip show calibreweb and compare the version with 0.6.17calibreweb to 0.6.17 or later0.0.0.0 and localhost at the network levelEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is due to an incomplete fix for CVE-2022-0339. The blacklist does not check for 0.0.0.0, which would result in a payload of 0.0.0.0 resolving to localhost.
This page as .md · .json · in your agent: get_signal("CVE-2022-0766")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.