---
id: CVE-2025-65858
aliases:
  - GHSA-pc5g-j9j7-p4q3
  - PYSEC-2026-1234
title: >-
  Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the
  'username' Field During User Creation
summary: >-
  Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the
  'username' Field During User Creation
severity: low
vendor: calibreweb
product: calibreweb
ecosystem: pip
affected:
  - calibreweb <= 0.6.25
published: '2025-12-02'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-pc5g-j9j7-p4q3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-65858'
  - url: >-
      https://github.com/KhanhDuy155/calibre-web-CVE-2025-65858/blob/main/CVE-2025-65858.md
  - url: 'https://github.com/janeczku/calibre-web'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.00206
epssPercentile: 0.10921
ingestedAt: '2026-07-08T18:25:51.743Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/KhanhDuy155/calibre-web-CVE-2025-65858'
  checkedAt: '2026-09-24T07:52:54.056Z'
exploitAvailable: true
---

## Overview

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.

## Affected packages

- `calibreweb <= 0.6.25`

## Remediation

Refer to the advisory for the patched release.