CVE-2026-33205

NameCVE-2026-33205
Descriptioncalibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Server-Side Request Forgery vulnerability in the background-image endpoint of calibre e-book reader's web view allows an attacker to perform blind GET requests to arbitrary URLs and exfiltrate information out from the ebook sandbox. Version 9.6.0 patches the issue.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
calibre (PTS)bullseye5.12.0+dfsg-1+deb11u2vulnerable
bullseye (security)5.12.0+dfsg-1+deb11u3vulnerable
bookworm6.13.0+repack-2+deb12u5vulnerable
trixie8.5.0+ds-1+deb13u1vulnerable
forky9.5.0+ds+~0.10.5-1vulnerable
sid9.6.0+ds+~0.10.5-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
calibresource(unstable)9.6.0+ds+~0.10.5-1

Notes

https://github.com/kovidgoyal/calibre/security/advisories/GHSA-4926-v9px-wv7v
Search for package or bug name: Reporting problems