Server-Side Request Forgery (SSRF) in janeczku/calibre-web
Description
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
SSRF vulnerability in calibre-web's cover upload function allows attackers to make requests to internal networks.
Vulnerability
Server-Side Request Forgery (SSRF) vulnerability exists in the cover upload functionality of calibre-web versions prior to 0.6.17 [2]. The save_cover_from_url function in cps/cover.py does not properly validate redirects or block all localhost IP addresses, allowing an attacker to craft a URL that redirects to internal network resources [3].
Exploitation
An attacker with the ability to upload a book cover from a URL can provide a malicious URL that, when fetched by the server, redirects to an internal IP address (e.g., 127.0.0.1, 0.0.0.0, or IPv6 loopback). The server follows the redirect without checking the final destination, enabling requests to internal services [3][4].
Impact
Successful exploitation allows the attacker to perform SSRF attacks, potentially accessing internal services, reading sensitive data, or interacting with other systems on the internal network that are not intended to be exposed [2][4].
Mitigation
The vulnerability is fixed in calibre-web version 0.6.17 [2]. The fix, implemented in commit 965352c, disallows redirects on cover uploads and adds additional IP address checks (0.0.0.0 and ::) to the localhost blocklist [3]. Users should upgrade to 0.6.17 or later. No workaround is documented.
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
calibrewebPyPI | < 0.6.17 | 0.6.17 |
Affected products
2- janeczku/janeczku/calibre-webv5Range: unspecified
Patches
1965352c8d96cDon't allow redirects on cover uploads, catch more addresses which resolve to localhost
1 file changed · +2 −2
cps/helper.py+2 −2 modified@@ -734,10 +734,10 @@ def save_cover_from_url(url, book_path): if not cli.allow_localhost: # 127.0.x.x, localhost, [::1], [::ffff:7f00:1] ip = socket.getaddrinfo(urlparse(url).hostname, 0)[0][4][0] - if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1": + if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1" or ip == "0.0.0.0" or ip == "::": log.error("Localhost was accessed for cover upload") return False, _("You are not allowed to access localhost for cover uploads") - img = requests.get(url, timeout=(10, 200)) # ToDo: Error Handling + img = requests.get(url, timeout=(10, 200), allow_redirects=False) # ToDo: Error Handling img.raise_for_status() return save_cover(img, book_path) except (socket.gaierror,
Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-2647-c639-qv2jghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-0766ghsaADVISORY
- github.com/janeczku/calibre-web/commit/965352c8d96c9eae7a6867ff76b0db137d04b0b8ghsax_refsource_MISCWEB
- huntr.dev/bounties/7f2a5bb4-e6c7-4b6a-b8eb-face9e3add7bghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.