CVE-2023-46303

Summary

link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/0x1717/ssrf-via-img
• https://github.com/kovidgoyal/calibre/compare/v6.18.1…v6.19.0
• https://lists.debian.org/debian-lts-announce/2024/09/msg00005.html

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/0x1717/ssrf-via-img
• https://github.com/kovidgoyal/calibre/compare/v6.18.1…v6.19.0

• ←Previous
• Next→