PT-2026-22384 · Calibre · Calibre

Mistz1 · Publicado 2026-01-01 · Atualizado 2026-04-21 · CVE-2026-27810

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions calibre versions prior to 9.4.0

Description calibre is an e-book manager for viewing, converting, editing, and cataloging e-books. A HTTP Response Header Injection exists in the calibre Content Server for versions before 9.4.0. An authenticated user can inject arbitrary HTTP headers into server responses through an unsanitized content disposition query parameter. This occurs in the /get/ and /data-files/get/ API endpoints. The issue is exploitable by any authenticated user, potentially through a crafted link. All users running the calibre Content Server with authentication enabled are affected.

Recommendations Update to calibre version 9.4.0 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-113

Identificadores relacionados

CVE-2026-27810

GHSA-5FPJ-FXW7-8GRW

OPENSUSE-SU-2026:10587-1

Produtos afetados

Calibre

Referências · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27810.json · Exploit
• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-5fpj-fxw7-8grw · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27810 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-33205 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27810 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2026:10587-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-25635 · Nota
• https://t.me/cveNotify/154146 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2026-26064 · Nota
• https://suse.com/security/cve/CVE-2026-25731 · Nota
• https://cve.org/CVERecord?id=CVE-2026-27810 · Nota de Segurança
• https://ubuntu.com/security/CVE-2026-27810 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-27824 · Nota
• https://suse.com/security/cve/CVE-2026-33206 · Nota
• https://suse.com/security/cve/CVE-2026-27810 · Nota