# CVE-2022-0766: Server-Side Request Forgery in calibreweb

Source: https://junglewise.ai/threats/cve-2022-0766-calibreweb-server-side-request-forgery-in-cover-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2022-0766 · Severity: critical · CVSS 9.8 · Published 2022-03-08

calibreweb is a web-based e-book management system that allows users to upload book covers from URLs. A server-side request forgery (SSRF) vulnerability in the cover upload feature allows attackers to make the server connect to internal services by bypassing address blacklist checks, potentially exposing sensitive internal systems or data.

Technologies: [calibreweb (PyPI)](https://junglewise.ai/threats/technologies/calibreweb). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-0766 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-0766 being exploited in the wild.

**How severe is CVE-2022-0766?** Critical severity, with a CVSS score of 9.8, published 8 March 2022.

**Which products and versions are affected?** calibreweb (PyPI) < 0.6.17, ECOSYSTEM:introduced=0,fixed=0.6.17.

**Is there a fix for CVE-2022-0766?** Yes. calibreweb (PyPI): upgrade to 0.6.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-0766 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-0766?** Check whether you run calibreweb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- calibreweb (PyPI): upgrade to 0.6.17 or later

  ```sh
  pip install "calibreweb>=0.6.17"
  ```


## Technical details

calibreweb prior to version 0.6.17 contains an incomplete fix for a prior SSRF vulnerability (CVE-2022-0339). The blacklist used to block requests to localhost and internal addresses fails to block the IP address 0.0.0.0, which resolves to localhost on many systems. An attacker can supply a malicious URL containing 0.0.0.0 in the cover upload functionality to bypass the blacklist and access internal services. This is a network-reachable vulnerability requiring no authentication or user interaction beyond requesting a cover upload. An attacker can use this to perform SSRF attacks against internal services, metadata servers, or cloud metadata endpoints.

## Affected products

- calibreweb calibreweb before 0.6.17

## Identifiers

- CVE-2022-0766
- GHSA-2647-c639-qv2j
- PYSEC-2026-304

## Timeline

- 2022-03-08: disclosed
- 2022-03-08: patched: Fixed in version 0.6.17

## References

- [https://github.com/janeczku/calibre-web/commit/965352c8d96c9eae7a6867ff76b0db137d04b0b8](https://github.com/janeczku/calibre-web/commit/965352c8d96c9eae7a6867ff76b0db137d04b0b8)

## Related threats

- [PYSEC-2026-1228 - Calibre Web and Autocaliweb have a ReDoS vulnerability](https://junglewise.ai/threats/cve-2025-6998-calibre-web-and-autocaliweb-redos-in-strip-whitespaces)
- [PYSEC-2026-1235 - Calibre Web and Autocaliweb have OS Command Injection vulnerability](https://junglewise.ai/threats/cve-2025-7404-calibre-web-and-autocaliweb-have-os-command-injection)
- [PYSEC-2026-1232 - Generation of Error Message Containing Sensitive Information in janeczku/calibre-web](https://junglewise.ai/threats/cve-2021-3986-generation-of-error-message-containing-sensitive-information-in)
- [PYSEC-2026-1236 - Cross-site Scripting (XSS) - DOM in janeczku/calibre-web](https://junglewise.ai/threats/cve-2021-3988-cross-site-scripting-xss-dom-in-janeczku-calibre-web)
- [PYSEC-2026-1229 - Improper Access Control in janeczku/calibre-web](https://junglewise.ai/threats/cve-2021-3987-improper-access-control-in-janeczku-calibre-web)