CVE-2026-27810

published 2026-02-27

CVE-2026-27810: calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection…

Priority P3 37 medium 6.4 CVSS 3.1

AV N AC L PR L UI N S C C L I L A N

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection vulnerability in the calibre Content Server allows any authenticated user to inject arbitrary HTTP headers into server responses via an unsanitized `content_disposition` query parameter in the `/get/` and `/data-files/get/` endpoints. All users running the calibre Content Server with authentication enabled are affected. The vulnerability is exploitable by any authenticated user and can also be triggered by tricking an authenticated victim into clicking a crafted link. Version 9.4.0 contains a fix for the issue.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
calibre-ebook	calibre	< 9.4.0	9.4.0
debian	calibre	< calibre 9.4.0+ds+~0.10.5-1 (forky)	calibre 9.4.0+ds+~0.10.5-1 (forky)
kovidgoyal	calibre	< 9.4.0	9.4.0
kovidgoyal	calibre	>= 0 < 9.4.0+ds+~0.10.5-1	9.4.0+ds+~0.10.5-1

CVSS provenance

nvd v3.1 6.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

osv 6.4 MEDIUM

vendor_debian 6.4 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-113