VulnerabilityAnalyzed

CVE-2024-6781

Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.

HIGH 7.5EPSS 62.4%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 62.4%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 62.44% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: calibre-ebook/calibre
Source: info@starlabs.sg

References

https://github.com/kovidgoyal/calibre/commit/bcd0ab12c41a887f8290a9b56e46c3a29038d9c4Patch
https://starlabs.sg/advisories/24/24-6781/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.