CVE-2024-6781: Arbitrary File Access in Calibre

The impact of CVE-2024-6781 is significant due to its ease of exploitation and the potential for data exposure. An attacker could leverage this vulnerability to read configuration files, user data, or even parts of the operating system. This could lead to the compromise of user accounts, intellectual property theft, or further system exploitation. The lack of authentication requirements means that any user with network access to a Calibre instance could potentially exploit this vulnerability. While not directly leading to remote code execution, the information gained could be used to identify other vulnerabilities or attack vectors.

1. Reserved2024-07-16
2. Published2024-08-06
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-6781 is to upgrade Calibre to version 7.14.1 or later. If upgrading is not immediately feasible, consider restricting network access to the Calibre instance to prevent external exploitation. While a direct workaround is not available, implementing strict file system permissions and access controls can help limit the potential damage if the vulnerability is exploited. Regularly review Calibre's configuration and ensure it adheres to security best practices. After upgrading, confirm the fix by attempting to access a restricted file via the vulnerable endpoint and verifying that access is denied.