VDB
CVE-2026-27810
CVE-2026-27810
PUBLISHED
CVSS 6.400000095367432 MEDIUM
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection vulnerability in the calibre Content Server allows any authenticated user to inject arbitrary HTTP headers into server responses via an unsanitized `content_disposition` query parameter in the `/get/` and `/data-files/get/` endpoints. All users running the calibre Content Server with authentication enabled are affected. The vulnerability is exploitable by any authenticated user and can also be triggered by tricking an authenticated victim into clicking a crafted link. Version 9.4.0 contains a fix for the issue.
EPSS 0.21% · 10.7th percentile
Risk Scores
CVSS 3.1
6.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS Score
0.21%
10.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| kovidgoyal | calibre | < 9.4.0, * |
| calibre-ebook | calibre | 0, 0 |
Timeline
- Feb 24, 2026 CVE ID Reserved
- Feb 27, 2026 CVE Published
- Feb 28, 2026 EPSS Score
- Mar 2, 2026 EPSS Score
- Mar 2, 2026 CVE Updated
- Mar 3, 2026 EPSS Score
- Mar 5, 2026 EPSS Score
- Mar 6, 2026 EPSS Score
- Mar 8, 2026 EPSS Score
- Mar 9, 2026 EPSS Score
- Mar 11, 2026 EPSS Score
- Mar 12, 2026 EPSS Score