Log in Start free

Vulnerability · Published Feb 27, 2026 · Assigned by GitHub_M

CVE-2026-27810calibre Vulnerable to HTTP Response Header Injection

Medium 6.4

In plain English

A medium-severity security flaw in calibre from kovidgoyal. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.2%top 84.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection vulnerability in the calibre Content Server allows any authenticated user to inject arbitrary HTTP headers into server responses via an unsanitized `content_disposition` query parameter in the `/get/` and `/data-files/get/` endpoints. All users running the calibre Content Server with authentication enabled are affected. The vulnerability is exploitable by any authenticated user and can also be triggered by tricking an authenticated victim into clicking a crafted link. Version 9.4.0 contains a fix for the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12calibre6.13.0+repack-2+deb12u6DEBIAN-CVE-2026-27810
Debian:13calibre8.5.0+ds-1+deb13u2DEBIAN-CVE-2026-27810
Debian:14calibre9.4.0+ds+~0.10.5-1DEBIAN-CVE-2026-27810
Ubuntu:22.04:LTScalibreno fix listedUBUNTU-CVE-2026-27810
Ubuntu:24.04:LTScalibreno fix listedUBUNTU-CVE-2026-27810
Ubuntu:25.10calibreno fix listedUBUNTU-CVE-2026-27810
Ubuntu:26.04:LTScalibreno fix listedUBUNTU-CVE-2026-27810
Ubuntu:26.10calibreno fix listedUBUNTU-CVE-2026-27810

Affected products (as reported)

VendorProductVersions
kovidgoyal calibre < 9.4.0

Weakness: CWE-113 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References