What’s Vulnerable › Vulnerabilities

CVE-2021-3988: Cross-site Scripting (XSS) in janeczku/calibre-web

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-11-15 · updated 2026-06-17
• Weakness: CWE-79

Description

A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the `#btn-upload-cover` change event.

Affected products

• janeczku/calibre-web: before 0.6.15 — fixed in 0.6.15

How to fix

Upgrade to a fixed version: janeczku/calibre-web 0.6.15. Check the vendor advisory for mitigations.

References

• https://github.com/janeczku/calibre-web/commit/7ad419dc8c12180e842a82118f4866ac3d074bc5
• https://huntr.com/bounties/fa4c8fd1-7846-4dad-9112-2c07461f0609

Get alerted when CVE-2021-3988 or the next vulnerability affects your stack