---
id: "CVE-2022-0767"
kind: "vulnerability"
aliases: ["CVE-2022-0767", "GHSA-h65g-jfqg-2w6m"]
title: "Server-Side Request Forgery in calibreweb"
severity: "critical"
cvss: 9.9
epss: 0.00985
exploited: false
status: "open"
category: "package"
products: [{"name": "calibreweb", "fixed": ["0.6.17"], "affected": "< 0.6.17", "ecosystem": "pypi"}, {"name": "janeczku calibre-web", "fixed": ["0.6.17"], "affected": "< 0.6.17", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["calibreweb", "cwe-918", "package", "python", "self-hosted"]
not_affected_if: ["fixed-version"]
published_at: "2022-03-07T07:15:07+00:00"
first_seen_at: "2026-10-27T16:20:27+00:00"
updated_at: "2026-10-27T16:33:07+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h65g-jfqg-2w6m", "first_seen_at": "2026-10-27T16:20:27+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0767", "first_seen_at": "2026-10-27T16:33:07+00:00"}]
---

# Server-Side Request Forgery in calibreweb

Calibre-Web before 0.6.17 has incomplete server-side request forgery protection that an attacker can bypass with an HTTP 302 redirect. The redirect can point the server at localhost, letting an attacker reach services only the server itself can see.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:calibreweb affected < 0.6.17 fixed 0.6.17
- vendor:janeczku calibre-web affected < 0.6.17 fixed 0.6.17

## How to check

- Check the installed version with `pip show calibreweb` and compare it to `0.6.17`.
- Look for `calibreweb` in `requirements.txt`, `pyproject.toml` or the Docker image tag.

## Fix

- Upgrade the `calibreweb` package to `0.6.17` or later.

## Timeline

- 2026-10-27T16:20:27+00:00 ghsa https://github.com/advisories/GHSA-h65g-jfqg-2w6m
- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-0767

## From the sources

calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to `localhost`.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_