Which versions of Calibre are affected by CVE-2026-33205?

Organizations using calibre should be aware of moderate risk from CVE-2026-33205, a server-side request forgery vulnerability rated CVSS 4.8.. A patch is available.

How to fix or mitigate CVE-2026-33205?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Calibre CVE-2026-33205

Q: What is the CVSS score of CVE-2026-33205?

CVE-2026-33205 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16610 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-27 GitHub_M

SSRF Calibre Kovidgoyal

4.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

9.6.0

EUVD ID Assigned

Mar 27, 2026 - 14:30 euvd

EUVD-2026-16610

Analysis Generated

Mar 27, 2026 - 14:30 vuln.today

CVE Published

Mar 27, 2026 - 13:52 nvd

MEDIUM 4.8

DescriptionGitHub Advisory

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Server-Side Request Forgery vulnerability in the background-image endpoint of calibre e-book reader's web view allows an attacker to perform blind GET requests to arbitrary URLs and exfiltrate information out from the ebook sandbox. Version 9.6.0 patches the issue.

AnalysisAI

Server-Side Request Forgery in calibre's background-image endpoint allows remote attackers to perform blind GET requests to arbitrary URLs and exfiltrate sensitive information from the e-book sandbox prior to version 9.6.0. Calibre versions before 9.6.0 are affected, with vendor-released patch available at version 9.6.0 or later. No active exploitation or public exploit code has been confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in calibre's web view component, specifically within the background-image endpoint handler. Calibre is a cross-platform e-book management application (CPE: cpe:2.3:a:kovidgoyal:calibre) that provides local web-based viewing and conversion functionality. The root cause is classified as CWE-918 (Server-Side Request Forgery), which occurs when the application constructs HTTP requests using user-supplied input without proper validation, allowing attackers to manipulate the request target. The background-image endpoint fails to sanitize or restrict the URL parameter, enabling an attacker to direct the server to fetch resources from internal networks, cloud metadata services, or arbitrary external systems. This creates an information disclosure pathway that bypasses the intended e-book sandbox isolation.

RemediationAI

Upgrade calibre to version 9.6.0 or later immediately. The vendor has released a patched version that removes the SSRF vulnerability from the background-image endpoint. If immediate upgrading is not feasible, restrict network access from calibre processes to internal services using host-based firewall rules or network segmentation, and disable or limit e-book file sources from untrusted origins. Additionally, consider running calibre in an isolated container or virtual machine environment to further restrict outbound network access and limit potential information exfiltration scope. Consult the vendor advisory at https://github.com/kovidgoyal/calibre/security/advisories/GHSA-4926-v9px-wv7v for technical details.