CVE-2026-33205

Name of the Vulnerable Software and Affected Versions calibre versions prior to 9.6.0

Description A Server-Side Request Forgery (SSRF) issue in the 'background-image' endpoint of the web view allows an attacker to perform blind GET requests to arbitrary URLs. This can lead to the exfiltration of information from the ebook sandbox. SSRF is a flaw where an attacker can force a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.

Recommendations Update to version 9.6.0 or later.