CVE-2025-7404: Critical OS Command Injection in Calibre-Web

CVE-2025-7404 is an OS command injection in Calibre-Web 0.6.24 and Autocaliweb 0.7.0, scored critical (9.8) in the record. The researcher who found it scored it 5.9 and says an admin login is needed. Autocaliweb 0.7.1 fixes it, and no Calibre-Web fix is confirmed.

What's affected

The record lists Calibre Web 0.6.24 (Nicolette) and Autocaliweb from 0.7.0 before 0.7.1. Autocaliweb is a fork of Calibre-Web, which is why both are affected. The record confirms a fixed version only for Autocaliweb: 0.7.1. It names no fixed Calibre-Web release, and I could not confirm one, so check the project's releases page.

The sources disagree on severity. The record shows CVSS 3.1 9.8 critical with no privileges required (PR:N). The advisory from Fluid Attacks, which found the flaw, shows CVSS 4.0 5.9 medium, with high privileges required (PR:H). The advisory says the flaw lives in the /admin/ajaxconfig endpoint, which an authenticated administrator uses to change settings, and that an admin user can cause a binary on the system to run by giving its absolute path. The path is passed with no arguments, and the output is not shown to the user, so the advisory calls it blind.

So the realistic reading is that it needs an administrator account, which lowers the risk for a private server and raises it for any instance with shared or weak admin credentials. The advisory says an exploit is available, and the record's KEV flag is false. I found no report of exploitation.

The weakness is CWE-78, OS command injection. The advisory's own description reads more like unchecked control of a path than of a full command line, and the impact depends on which binaries exist on the host.

How to check if you're exposed

Find your version. For Calibre-Web installed with pip:

pip show calibreweb

For a container, list the image tag you run:

docker ps --format "{{.Names}} {{.Image}}"

The admin area of both applications also shows version information. If you run Autocaliweb 0.7.0, you are affected. If you run Calibre-Web 0.6.24, treat yourself as affected until the project says otherwise.

Then ask who holds admin rights. List every admin account, remove ones that are not needed, and check that none shares a password with another service. Check whether the admin interface is reachable from the internet. Finally, review the setting that stores the path of the helper binary the advisory mentions, which should point to the file you expect and nothing else.

What to do now

1. Find every Calibre-Web and Autocaliweb instance you run.
2. Upgrade Autocaliweb to 0.7.1 or later.
3. For Calibre-Web, check the project's releases for a fix and plan to upgrade when one is confirmed.
4. Until then, limit admin accounts, use unique strong passwords and keep the interface off the public internet or behind a VPN or reverse proxy login.
5. Review the saved configuration for unexpected file paths.
6. Run the application as an unprivileged user, so a misused binary can do less.

Why it matters

The setting is checked only for existence. The code confirms a file is there and then hands it to the operating system to run. A check that proves something exists says nothing about whether it is safe to execute.

The gap between the two scores is a useful lesson. Both are honest readings of the same bug. The base score from the record assumes anyone can reach it. The researcher's score assumes you must already be an admin. For a self hosted library, the second reading is closer to how most people run it, but a shared admin password turns a medium problem into a serious one.

Try it yourself

See how a fixed version is spotted and prioritised when a patch exists for part of the affected range.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Fluid Attacks advisory (code name kino)
• Autocaliweb on GitHub
• Calibre-Web on GitHub
• CVE-2025-7404 on Safeguard Gold

Last reviewed: 18 October 2026.