critical9.8
CVE-2025-7404
Calibre Web and Autocaliweb have OS Command Injection vulnerability
Impact
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | calibreweb | <= 0.6.24 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gelbphoenix | Autocaliweb | Version 0.7.0 |
| Janeczku | Calibre-Web | Version 0.6.24 |