CVE-2021-25964: Stored Cross-Site Scripting (XSS) in Calibre-web via Description Field in Metadata

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-04 · updated 2026-06-17
Weakness: CWE-79

Description

In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered.

Affected products

janeczku/calibre-web: from 0.6.0 before 0.6.12 — fixed in 0.6.12

How to fix

Upgrade to a fixed version: janeczku/calibre-web 0.6.12. Check the vendor advisory for mitigations.

References

https://github.com/janeczku/calibre-web/commit/32e27712f0f71fdec646add20cd78b4ce75acfce
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25964
https://github.com/janeczku/calibre-web/commit/32e27712f0f71fdec646add20cd78b4ce75acfce
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25964

Get alerted when CVE-2021-25964 or the next vulnerability affects your stack