{"id":"CVE-2022-30765","kind":"vulnerability","aliases":["CVE-2022-30765","GHSA-8ppf-x4gr-2x7g"],"related":[],"title":"SQL injection in calibreweb","description":"Calibre-Web before 0.6.18 allows user table SQL Injection.","summary":"Calibre-Web versions before 0.6.18 let an attacker inject SQL through a user table query. The attacker can read or change the application's database contents.","severity":"critical","cvss":9.8,"epss":0.01207,"exploited":false,"exploited_at":null,"products":[{"name":"calibreweb","fixed":["0.6.18"],"affected":"< 0.6.18","ecosystem":"pypi"},{"name":"janeczku calibre-web","fixed":[],"affected":"= 0.6.18","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["calibreweb","cwe-89","package","python","self-hosted"],"not_affected_if":["version-0.6.18-or-later"],"how_to_check":"- Run `pip show calibreweb` and confirm the version is below `0.6.18`\n- Check the installed version with `pip freeze | grep -i calibreweb`","fix":"- Upgrade the pypi package `calibreweb` to `0.6.18` or later","status":"open","published_at":"2022-05-16T02:15:06+00:00","first_seen_at":"2026-10-27T16:20:27+00:00","triaged_at":"2026-10-27T16:21:24+00:00","updated_at":"2026-10-27T16:33:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T16:21:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the pypi package `calibreweb` to `0.6.18` or later","reach":"unknown","title":"calibreweb: SQL injection in user table lets attackers read or change data","impact":"high","summary":"Calibre-Web versions before 0.6.18 let an attacker inject SQL through a user table query. The attacker can read or change the application's database contents.","category":"package","nicknames":[],"who_cares":["calibreweb","python","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker reads or alters the Calibre-Web database contents","analyst_note":"","how_to_check":"- Run `pip show calibreweb` and confirm the version is below `0.6.18`\n- Check the installed version with `pip freeze | grep -i calibreweb`","needs_analyst":false,"not_affected_if":["version-0.6.18-or-later"],"who_is_affected":"Teams running Calibre-Web from PyPI at a version before 0.6.18 are affected. The sources do not say which features or configurations are needed to reach the vulnerable query, so exposure beyond the version check is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000544,"input_tokens":3278,"output_tokens":432,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2022':6A,14A '-30765':7A,15A '-89':23B '0.6.18':34B,60C '2x7g':12A '8ppf':10A 'allow':61C 'applic':52B 'attack':37B,46B 'calibr':30B,57C 'calibre':19A 'calibre-web':18A,29B,56C 'calibreweb':4A,16A,21B 'chang':50B 'content':55B 'cve':5A,13A 'cwe':22B 'databas':54B 'ghsa':9A 'ghsa-8ppf-x4gr-2x7g':8A 'host':28B 'inject':2A,38B,65C 'janeczku':17A 'let':35B 'packag':24B 'python':25B 'queri':44B 'read':48B 'self':27B 'self-host':26B 'sql':1A,39B,64C 'tabl':43B,63C 'user':42B,62C 'version':32B 'web':20A,31B,58C 'x4gr':11A","nicknames":[],"mitigations":[],"who_affected":"Teams running Calibre-Web from PyPI at a version before 0.6.18 are affected. The sources do not say which features or configurations are needed to reach the vulnerable query, so exposure beyond the version check is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2022-05-16T02:15:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-8ppf-x4gr-2x7g","url":"https://github.com/advisories/GHSA-8ppf-x4gr-2x7g","severity":"critical","published_at":"2022-05-17T00:01:46+00:00","modified_at":"2026-10-27T16:19:05+00:00","first_seen_at":"2026-10-27T16:20:27+00:00","fetched_at":"2026-10-27T16:20:27+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-30765","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30765","severity":null,"published_at":"2022-05-16T02:15:06+00:00","modified_at":"2026-06-17T04:44:15+00:00","first_seen_at":"2026-10-27T16:33:08+00:00","fetched_at":"2026-10-27T16:33:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}