Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-46303: Calibre may write files outside its document folder
CVE-2023-46303 · published 3 years ago
Summary
Versions of Calibre before 6.19 on Debian can place files outside the intended document directory during ebook conversion. This could allow unwanted files to be added to the system, potentially leading to misuse. Upgrade Calibre to version 6.19 or later, or apply the available security patch.
What to do
- Update debian calibre to version 6.13.0+repack-2+deb12u3.
- Update debian calibre to version 6.19.1-1.
- Update calibre-ebook calibre to version 6.19.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | calibre |
< 6.13.0+repack-2+deb12u3 Fix: upgrade to 6.13.0+repack-2+deb12u3
|
| Debian:13 | debian | calibre |
< 6.19.1-1 Fix: upgrade to 6.19.1-1
|
| Debian:14 | debian | calibre |
< 6.19.1-1 Fix: upgrade to 6.19.1-1
|
| – | calibre-ebook | calibre |
< 6.19.0 cpe:2.3:a:calibre-ebook:calibre:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | calibre | All versions |
Original advisory text
link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.
link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.
References
- https://security-tracker.debian.org/tracker/CVE-2023-46303 Vendor Advisory
- https://ubuntu.com/security/CVE-2023-46303 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-46303 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00005.html URL
- https://github.com/kovidgoyal/calibre/compare/v6.18.1...v6.19.0 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46303... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-46303 Vendor Advisory
- https://github.com/0x1717/ssrf-via-img Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published22 Oct 2023
Updated4 Nov 2026
First seen15 Sep 2026
Sources
DEBIAN-CVE-2023-46303 · OSV
CVE-2023-46303 · NVD
UBUNTU-CVE-2023-46303 · OSV
CVE-2023-46303 · OSV
Track software like this
Free during beta