CVE-2025-7404
Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C
- State
- Published
- Severity
- 5.9 Medium
- Published
- Jul 24, 2025
- Updated
- Jul 25, 2025
- Reserved
- Jul 10, 2025
Description
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.9 Medium | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N | Fluid Attacks |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
Calibre WebCalibre Web |
|
AutocaliwebAutocaliweb |
|
References
- https://fluidattacks.com/advisories/kinothird-party-advisory
- https://github.com/janeczku/calibre-webproduct
- https://github.com/gelbphoenix/autocaliwebproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.