CVE-2026-33205 calibre has Server-Side Request Forgery in ebook viewer backend

What is CVE-2026-33205?

CVE-2026-33205 is a medium-severity server-side request forgery vulnerability in kovidgoyal calibre, published on 27 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Server-Side Request Forgery vulnerability in the background-image endpoint of calibre e-book reader's web view allows an attacker to perform blind GET requests to arbitrary URLs and exfiltrate information out from the ebook sandbox. Version 9.6.0 patches the issue.

Weakness: CWE-918

Which versions are affected by CVE-2026-33205?

It affects 1 product.

Products include Calibre-Ebook Calibre.

How do I fix CVE-2026-33205?

Upgrade to a fixed version.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-33205 being exploited?

There is no known exploitation of CVE-2026-33205 in the wild and no public exploit code.

Other vulnerabilities in kovidgoyal calibre

• CVE-2011-4124 Command injection in Calibre Critical 9.8
• CVE-2011-4125 Privilege escalation in Calibre Critical 9.8
• CVE-2026-26064 calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution Critical 9.3
• CVE-2026-26065 calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution Critical 9.3
• CVE-2026-25635 calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-33205, GHSA-4926-v9px-wv7v, UBUNTU-CVE-2026-33205.