DEBIAN-CVE-2026-33205

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-33205
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33205.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-33205
Upstream
Published
2026-03-27T15:16:54Z
Modified
2026-09-14T17:03:07Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Server-Side Request Forgery vulnerability in the background-image endpoint of calibre e-book reader's web view allows an attacker to perform blind GET requests to arbitrary URLs and exfiltrate information out from the ebook sandbox. Version 9.6.0 patches the issue.

References

Affected packages

Debian:12 / calibre

Package

Name
calibre
Purl
pkg:deb/debian/calibre?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.13.0+repack-2+deb12u9

Affected versions

6.*
6.13.0+repack-2
6.13.0+repack-2+deb12u1
6.13.0+repack-2+deb12u2
6.13.0+repack-2+deb12u3
6.13.0+repack-2+deb12u4
6.13.0+repack-2+deb12u5
6.13.0+repack-2+deb12u6
6.13.0+repack-2+deb12u7
6.13.0+repack-2+deb12u8

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33205.json"

Debian:13 / calibre

Package

Name
calibre
Purl
pkg:deb/debian/calibre?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.5.0+ds-1+deb13u3

Affected versions

8.*
8.5.0+ds-1
8.5.0+ds-1+deb13u1
8.5.0+ds-1+deb13u2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33205.json"

Debian:14 / calibre

Package

Name
calibre
Purl
pkg:deb/debian/calibre?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.0+ds+~0.10.5-1

Affected versions

8.*
8.5.0+ds-1
8.6.0+ds-1
8.7.0+ds-1
8.8.0+ds-1
8.8.0+ds-2
8.8.0+ds-2+gcc15
8.8.0+ds-3
8.9.0+ds-1
8.9.0+ds-2
8.9.0+ds-3
8.9.0+ds-4
8.10.0+ds-1
8.10.0+ds-2
8.10.0+ds-3
8.11.0+ds+~0.10.5-1
8.11.1+ds+~0.10.5-1
8.11.1+ds+~0.10.5-2
8.11.1+ds+~0.10.5-3
8.12.0+ds+~0.10.5-1
8.13.0+ds+~0.10.5-1
8.13.0+ds+~0.10.5-2
8.13.0+ds+~0.10.5-3
8.14.0+ds+~0.10.5-1~bpo13+1
8.14.0+ds+~0.10.5-1
8.15.0+ds+~0.10.5-1~bpo13+1
8.15.0+ds+~0.10.5-1
8.15.0+ds+~0.10.5-2
8.16.0+ds+~0.10.5-1
8.16.0+ds+~0.10.5-2
8.16.1+ds+~0.10.5-1
8.16.2+ds+~0.10.5-1
8.16.2+ds+~0.10.5-2
8.16.2+ds+~0.10.5-3~bpo13+1
8.16.2+ds+~0.10.5-3
9.*
9.0.0+ds+~0.10.5-1
9.1.0+ds+~0.10.5-1
9.2.0+ds+~0.10.5-1
9.2.1+ds+~0.10.5-1
9.2.1+ds+~0.10.5-2
9.3.0+ds+~0.10.5-1
9.3.1+ds+~0.10.5-1
9.4.0+ds+~0.10.5-1
9.5.0+ds+~0.10.5-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33205.json"