Listen to this Post
The vulnerability exists in the user creation functionality of Calibre-Web version 0.6.25. When an administrative user creates a new account, the ‘username’ field does not properly sanitize or escape user-supplied input. An attacker, with the ability to create users (typically requiring admin privileges), can inject malicious JavaScript code as part of the username. This payload is then stored persistently in the application’s database. The stored payload is later executed in the browser of any authenticated user, including administrators, who accesses the `/ajax/listusers` endpoint. This endpoint likely renders the unsanitized username data directly into the HTML response without proper output encoding, triggering the script execution in the victim’s context.
Platform: Calibre-Web
Version: v0.6.25
Vulnerability: Stored XSS
Severity: Low
Date: Dec 2, 2025
Prediction: Patch imminent
What Undercode Say:
curl -X POST 'http://target/admin/user/new' -d "username=<script>alert('XSS')</script>"
curl --cookie "session=admin_cookie" 'http://target/ajax/listusers'
// Payload example username: <img src=x onerror=stealCookies()>
How Exploit:
1. Attacker gains administrative access.
2. Creates new user with malicious username.
3. Victim views user list.
4. Payload executes automatically.
Protection from this CVE
- Sanitize user input.
- Implement output encoding.
- Update Calibre-Web version.
Impact:
- Session hijacking possible.
- Low privilege required.
- Limited attack scope.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
