CVE-2026-27810 calibre Vulnerable to HTTP Response Header Injection

What is CVE-2026-27810?

CVE-2026-27810 is a medium-severity vulnerability in kovidgoyal calibre, published on 27 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection vulnerability in the calibre Content Server allows any authenticated user to inject arbitrary HTTP headers into server responses via an unsanitized `content_disposition` query parameter in the `/get/` and `/data-files/get/` endpoints. All users running the calibre Content Server with authentication enabled are affected. The vulnerability is exploitable by any authenticated user and can also be triggered by tricking an authenticated victim into clicking a crafted link. Version 9.4.0 contains a fix for the issue.

Weakness: CWE-113

Which versions are affected by CVE-2026-27810?

It affects 1 product.

Products include Calibre-Ebook Calibre.

How do I fix CVE-2026-27810?

Upgrade to a fixed version.

Is CVE-2026-27810 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27810 exists.

Other vulnerabilities in kovidgoyal calibre

• CVE-2011-4124 Command injection in Calibre Critical 9.8
• CVE-2011-4125 Privilege escalation in Calibre Critical 9.8
• CVE-2026-26064 calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution Critical 9.3
• CVE-2026-26065 calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution Critical 9.3
• CVE-2026-25635 calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-27810, GHSA-5fpj-fxw7-8grw, UBUNTU-CVE-2026-27810.