CVE-2025-7404
CVE-2025-7404 · Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
CVSS 5.9 · Medium · EPSS 2.8% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
calibre web
- Versions
- 0.6.24: Affected (custom)
No fix published
autocaliweb
- Versions
- ≥ 0.7.0, < 0.7.1: Affected (custom)
Update to 0.7.1
calibreweb PyPI
- Versions
- 0.6.12
- 0.6.13
- 0.6.14
- 0.6.15
- 0.6.16
- 0.6.17
- 0.6.18
- 0.6.19
- 0.6.20
- 0.6.21
- 0.6.22
- 0.6.23
- 0.6.24
- Affected ranges
- ECOSYSTEM: ≤ 0.6.24
No fix published