---
id: CVE-2021-4164
aliases:
  - GHSA-wxr6-29pv-ch68
  - PYSEC-2026-621
title: calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
summary: calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H'
vendor: calibreweb
product: calibreweb
ecosystem: pip
affected:
  - calibreweb < 0.6.15
patched:
  - calibreweb 0.6.15
published: '2022-01-21'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wxr6-29pv-ch68'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-4164'
  - url: >-
      https://github.com/janeczku/calibre-web/commit/785726deee13b4d56f6c3503dd57c1e3eb7d6f30
  - url: 'https://github.com/janeczku/calibre-web'
  - url: 'https://huntr.dev/bounties/2debace1-a0f3-45c1-95fa-9d0512680758'
tags:
  - osv
  - pip
epss: 0.00545
epssPercentile: 0.43246
ingestedAt: '2026-07-08T18:25:53.940Z'
---

## Overview

calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)

## Affected packages

- `calibreweb < 0.6.15`

## Remediation

Upgrade to a patched release:

- `calibreweb 0.6.15`