SB2026080337 - Multiple vulnerabilities in Calibre

Description

This security bulletin contains information about 2 vulnerabilities.

1) Eval Injection (CVE-ID: N/A)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the template() function and formatter when processing crafted composite_template metadata from an opened document. A remote attacker can trick the victim into opening a crafted EPUB or PDF file to execute arbitrary code.

User interaction is required to open a crafted file.

2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify server-side annotation data.

The vulnerability exists due to missing authorization in the /book-update-annotations endpoint when handling POST requests that merge and persist annotation JSON for a readable book. A remote attacker can send a specially crafted request to modify server-side annotation data.

Only books the caller is allowed to access can be targeted, and deployments with readonly users or anonymous network access are affected.

Remediation

Install update from vendor's website.

References

• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-4f7g-rjfp-hmvx
• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-5x64-w63v-x2g6