SVI/ProxmoxVE
1
0
Fork 0
mirror of https://github.com/community-scripts/ProxmoxVE.git synced 2026-03-31 06:34:17 -04:00
Code Issues 2.6k Packages Projects Releases 10 Wiki Activity

Upstream Calibre-Web application has unpatched vulnerabilities #1570

New Issue
Closed
opened 2025-11-20 05:12:35 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 05:12:35 -05:00
Owner
Copy Link

Originally created by @vhsdream on GitHub (Jul 25, 2025).

✅ Have you read and understood the above guidelines?

yes

📜 What is the name of the script you are using?

calibre-web

📂 What was the exact command used to execute the script?

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/calibre-web.sh)"

⚙️ What settings are you using?

  • Default Settings
  • Advanced Settings

🖥️ Which Linux distribution are you using?

Debian 12

📝 Provide a clear and concise description of the issue.

2 weeks ago a security team attempted to make contact with the Calibre-Web dev and received no response. Today they have published the details of two vulnerabilities in the application, you can read about them here and here.

Since Calibre-Web hasn't had an update in some time, these vulnerabilities remain in the stable release that is used by the Helper Script.

Some info about the vulns:

  • the Blind Command Injection vulnerability requires a malicious, authenticated Admin user to set the path to a malicious command or script. The vulnerable function will blindly execute the command, since there is no validation. It's possible to get a reverse shell via this method, but again, this can only be achieved by authenticated admins, so it's mitigated somewhat.
  • the reDOS vulnerability allows any unauthenticated attacker to cause a denial of service by sending specially crafted input to the login form. Since this is possible without any authentication, Calibre-Web instances open to the internet are definitely vulnerable to this.

As far as I can tell, these vulns have only been patched in Autocaliweb - a fork of Calibre-Web and Calibre-Web Automated.

🔄 Steps to reproduce the issue.

See description

❌ Paste the full error output (if available).

See description

🖼️ Additional context (optional).

I just wanted to make this issue so that people using Calibre-Web are aware of this. I also want to make clear that the install and update scripts hosted by the Community Scripts org are not the source of the vulnerabilities - it's the upstream Calibre-Web source over which the org has no control.

We might want to consider temporarily removing the Calibre-Web scripts from the repo until there is an update from the Calibre-Web dev.

Originally created by @vhsdream on GitHub (Jul 25, 2025). ### ✅ Have you read and understood the above guidelines? yes ### 📜 What is the name of the script you are using? calibre-web ### 📂 What was the exact command used to execute the script? bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/calibre-web.sh)" ### ⚙️ What settings are you using? - [x] Default Settings - [ ] Advanced Settings ### 🖥️ Which Linux distribution are you using? Debian 12 ### 📝 Provide a clear and concise description of the issue. 2 weeks ago a security team attempted to make contact with the Calibre-Web dev and received [no response](https://github.com/janeczku/calibre-web/issues/3427). Today they have published the details of two vulnerabilities in the application, you can read about them [here](https://fluidattacks.com/advisories/megadeth) and [here](https://fluidattacks.com/advisories/kino). Since Calibre-Web hasn't had an update in some time, these vulnerabilities remain in the stable release that is used by the Helper Script. Some info about the vulns: - the Blind Command Injection vulnerability requires a malicious, authenticated Admin user to set the path to a malicious command or script. The vulnerable function will blindly execute the command, since there is no validation. It's possible to get a reverse shell via this method, but again, this can only be achieved by authenticated admins, so it's mitigated somewhat. - the reDOS vulnerability allows any unauthenticated attacker to cause a denial of service by sending specially crafted input to the login form. Since this is possible without any authentication, Calibre-Web instances open to the internet are definitely vulnerable to this. As far as I can tell, these vulns have only been patched in [Autocaliweb](https://github.com/gelbphoenix/autocaliweb) - a fork of Calibre-Web and Calibre-Web Automated. ### 🔄 Steps to reproduce the issue. See description ### ❌ Paste the full error output (if available). See description ### 🖼️ Additional context (optional). I just wanted to make this issue so that people using Calibre-Web are aware of this. I also want to make clear that the install and update scripts hosted by the Community Scripts org are not the source of the vulnerabilities - it's the upstream Calibre-Web source over which the org has no control. We might want to consider temporarily removing the Calibre-Web scripts from the repo until there is an update from the Calibre-Web dev.
saavagebueno added the not a script issueexternalsecurity labels 2025-11-20 05:12:35 -05:00
saavagebueno commented 2025-11-20 05:12:35 -05:00
Author
Owner
Copy Link

@MickLesk commented on GitHub (Jul 25, 2025):

I don't use calibre, but from your description this looks like a critical CVE.

In my opinion we should remove the json from the website and backup the install script until a new version is released, what do you think?

@MickLesk commented on GitHub (Jul 25, 2025): I don't use calibre, but from your description this looks like a critical CVE. In my opinion we should remove the json from the website and backup the install script until a new version is released, what do you think?
saavagebueno commented 2025-11-20 05:12:36 -05:00
Author
Owner
Copy Link

@vhsdream commented on GitHub (Jul 25, 2025):

Realistically speaking, the worst that could happen is the denial of service. Although it's not outside the realm of possibility that you have people out there who didn't change the default admin password (or have an easily brute-forced one) that have exposed their Calibre-Web to the internet, in which case an attacker could gain root-level access to the LXC. Luckily by default it's unprivileged, but still not a good idea to have any kind of compromise.

I agree with you and think we should pull the script.

@vhsdream commented on GitHub (Jul 25, 2025): Realistically speaking, the worst that could happen is the denial of service. Although it's not outside the realm of possibility that you have people out there who didn't change the default admin password (or have an easily brute-forced one) that have exposed their Calibre-Web to the internet, in which case an attacker could gain root-level access to the LXC. Luckily by default it's unprivileged, but still not a good idea to have any kind of compromise. I agree with you and think we should pull the script.
saavagebueno commented 2025-11-20 05:12:36 -05:00
Author
Owner
Copy Link

@michelroegl-brunner commented on GitHub (Jul 26, 2025):

Removed for now.

@michelroegl-brunner commented on GitHub (Jul 26, 2025): Removed for now.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
🛑 Failure to comply with the guidelines
breaking change
bug
bug
bugfix
deferred
delete script
dependencies
enhancement
external
feature
github
help wanted
Implemented in VED waiting push to Main
in project pipeline
invalid
investigation
json
maintenance
new script
new script
nice to have
not a script issue
not planned
organization
pull-request
Mirrored from GitHub Pull Request
 question
refactor
rename script
security
update script
website
wontdo
No Label external not a script issue security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/ProxmoxVE#1570
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?