CVE-2024-6782

What it actually does

CVE-2024-6782 is an improper access control flaw in Calibre versions 6.9.0 through 7.14.0 that can allow a network-accessible Calibre service to execute attacker-controlled code without authentication. Because exploitation requires no credentials, no user interaction, and low complexity, a vulnerable Calibre Content Server exposed to an untrusted network can be taken over remotely. Successful exploitation gives the attacker code execution with the privileges of the Calibre server process, enabling access to local files, modification of ebook libraries and metadata, staging of additional tooling, and potential lateral movement from the host.

Why it matters to the business

Organizations running vulnerable Calibre servers face a high-risk remote compromise scenario: an internet- or intranet-accessible service could be used as an entry point to steal documents, alter hosted content, disrupt ebook/library services, deploy malware, or pivot further into the network. The vulnerability has a high EPSS score of 0.84236 and is marked weaponized, which indicates a substantial likelihood of real-world exploitation even though it is not currently listed in CISA KEV. Systems still running affected versions more than a year after publication should be treated as urgent remediation candidates.

How an attack unfolds

An attacker first identifies a reachable Calibre Content Server, commonly by scanning for Calibre HTTP service banners, default service ports, page titles, or exposed library interfaces. If the server is running Calibre 6.9.0 through 7.14.0, the attacker sends a crafted unauthenticated HTTP request that reaches functionality that should have been access-controlled. Due to the authorization bypass, the request is processed in a way that causes attacker-supplied input to be executed by the server. The resulting code runs under the Calibre service account, after which the attacker may enumerate local files, read or alter the Calibre library, create persistence, download additional payloads, or use the host as a foothold for broader compromise.

How to fix it

Upgrade Calibre immediately to a non-vulnerable release. Versions 6.9.0 through 7.14.0 are affected; deploy Calibre 7.15.0 or later where available, or build from source at or after upstream commit 38a1bf50d8cd22052ae59c513816706c6445d5e9. If immediate upgrade is not possible, restrict the Calibre Content Server so it is not reachable from the internet or untrusted networks, require access through a VPN or authenticated reverse proxy, block inbound access at firewalls, and run the service with the least-privileged dedicated account. Avoid running Calibre as an administrator/root user. After patching, rotate any credentials, API tokens, or secrets that may have been accessible from the host if compromise is suspected.

How to confirm the fix worked

Confirm installed Calibre versions are outside the affected range by checking package manager inventory, container images, desktop/server application versions, and source builds. Validate that any source deployment includes commit 38a1bf50d8cd22052ae59c513816706c6445d5e9 or later. From a network perspective, verify that Calibre Content Server is not exposed to untrusted networks unless intentionally required and protected by compensating controls. Review firewall, reverse proxy, and service binding configuration to ensure access is limited to approved addresses. Confirm the Calibre process runs as a non-privileged account. Where vulnerability scanners are used, rescan after upgrade and verify that detections for Calibre 6.9.0 through 7.14.0 are cleared.

Typical attack path

1. Scan the internet or internal address space for exposed Calibre Content Server instances.
2. Fingerprint the service version or infer vulnerability from response behavior, banners, static assets, or package inventory.
3. Send a crafted unauthenticated HTTP request to the vulnerable Calibre service.
4. Achieve remote code execution as the operating-system user running the Calibre process.
5. Run reconnaissance commands to determine host privileges, network reachability, and sensitive file locations.
6. Access or modify Calibre library data and local files available to the service account.
7. Stage follow-on tools, establish persistence, exfiltrate data, or pivot to adjacent systems.

How to detect it

Investigate both network and host telemetry. Useful log sources include Calibre server logs, reverse proxy logs, web access logs, firewall and NetFlow records, EDR process telemetry, command-line auditing, Linux auditd, Windows Event Logs/Sysmon, package inventory, and file integrity monitoring. Look for unauthenticated HTTP requests to Calibre immediately followed by unexpected process creation by the Calibre service, especially shells, scripting interpreters, download tools, archive utilities, or outbound connections. On Linux, review shell history, cron/systemd changes, new files under temporary directories, and processes spawned by calibre-server. On Windows, review child processes of calibre.exe/calibre-server.exe, PowerShell activity, scheduled tasks, startup-folder changes, and suspicious downloads. Because public exploit code is reported as weaponized, absence of a known signature should not be considered proof of safety; prioritize behavioral indicators such as Calibre spawning operating-system commands or making unusual outbound connections.

• calibre-server
• calibre-server.exe
• calibre.exe
• /usr/bin/calibre-server
• /usr/local/bin/calibre-server
• /opt/calibre/calibre-server
• C:\\Program Files\\Calibre2\\calibre-server.exe
• C:\\Program Files\\Calibre2\\calibre.exe
• calibre-server spawned /bin/sh
• calibre-server spawned /bin/bash
• calibre-server spawned cmd.exe
• calibre-server spawned powershell.exe
• calibre-server spawned python
• calibre-server spawned python3
• calibre-server spawned curl
• calibre-server spawned wget
• calibre-server spawned nc
• calibre-server spawned netcat
• ParentImage=*calibre* Image=*/bin/sh
• ParentImage=*calibre* Image=*/bin/bash
• ParentImage=*calibre* Image=*cmd.exe
• ParentImage=*calibre* Image=*powershell.exe
• ParentImage=*calibre* Image=*curl*
• ParentImage=*calibre* Image=*wget*
• ParentImage=*calibre* Image=*nc*
• ParentImage=*calibre* Image=*netcat*

What your security team should do

• Prioritize patching or isolating all Calibre 6.9.0 through 7.14.0 instances because exploitation is weaponized and the EPSS score is high.
• Inventory internet-facing and internally reachable Calibre Content Server deployments, including unmanaged workstations, lab systems, containers, and self-hosted library servers.
• Upgrade to Calibre 7.15.0 or later, or verify source deployments include commit 38a1bf50d8cd22052ae59c513816706c6445d5e9 or later.
• Immediately remove public exposure for Calibre services unless there is a documented business requirement and strong access control in front of the service.
• Hunt for suspicious child processes spawned by Calibre, especially shells, scripting engines, download utilities, or network tools.
• Review historical HTTP access logs for unauthenticated requests to Calibre endpoints followed by abnormal process execution, file changes, or outbound network connections.
• If exploitation is suspected, isolate the host, preserve logs and disk artifacts, collect EDR telemetry, rotate potentially exposed secrets, and perform full incident response scoping.