Live › vulnerability › CVE-2022-0767
Go to dashboardCalibre-Web before 0.6.17 has incomplete server-side request forgery protection that an attacker can bypass with an HTTP 302 redirect. The redirect can point the server at localhost, letting an attacker reach services only the server itself can see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:20 UTC, 0h before NVD. All times on this page are UTC.
Any Calibre-Web instance below 0.6.17 that fetches remote URLs on behalf of users is in scope, since the SSRF is reachable through the server's outbound request path. Deployments that are pinned at 0.6.17 or newer, or that do not make outbound requests, are not affected. The sources do not say which features trigger the outbound request.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| calibreweb | pypi | < 0.6.17 | 0.6.17 |
| janeczku calibre-web | vendor | < 0.6.17 | 0.6.17 |
pip show calibreweb and compare it to 0.6.17.calibreweb in requirements.txt, pyproject.toml or the Docker image tag.calibreweb package to 0.6.17 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to localhost.
This page as .md · .json · in your agent: get_signal("CVE-2022-0767")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.