CVE-2025-7404: Gelbphoenix Autocaliweb

Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

Affected products

• Gelbphoenix Autocaliweb: version 0.7.0 only
• Janeczku Calibre-Web: version 0.6.24 only

Published 2025-07-24. Last modified 2026-06-17.