Vulnerability · Published Aug 12, 2025 · Assigned by GitHub_M

CVE-2025-55165Autocaliweb Exposure of Sensitive Information to an Unauthorized Actor in `config_sql.py`

High 8.3

In plain English

A high-severity information exposure in autocaliweb from gelbphoenix. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.3%top 76.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the to_dict() method, used to serialize configuration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the full contents, might share these debug packs, inadvertently leaking their private API keys. This issue has been patched in version 0.8.3.

Affected products (as reported)

Vendor	Product	Versions
gelbphoenix	autocaliweb	< 0.8.3

Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/gelbphoenix/autocaliweb/security/advisories/GHSA-44vp-wgh9-9535 x_refsource_CONFIRM
https://github.com/gelbphoenix/autocaliweb/commit/f455051f7c758ae8490186718b73e449f353b702 x_refsource_MISC
https://github.com/gelbphoenix/autocaliweb/releases/tag/v0.8.3 x_refsource_MISC