GitHub Advisoryadvisory · PyPI

GHSA-qc4j-v7h6-xr5h Calibre Web and Autocaliweb have OS Command Injection vulnerability

MEDIUM Published 2025-07-24 Modified 2025-07-25 Official page ↗
Aliases
CVE-2025-7404
Ecosystem
PyPI
Packages
calibreweb
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-78
Reviewed
2025-07-25

Affected packages

• PyPI calibreweb: <= 0.6.24 (no fix yet)

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

Related

Alias · CVE (1)

  • CVE-2025-7404 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References