Vulnerability details

CVE-2025-55165

gelbphoenix autocaliweb

Autocaliweb Exposure of Sensitive Information to an Unauthorized Actor in `config_sql.py`

CVSS 3.1

8.3High

Official description

Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the to_dict() method, used to serialize configuration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the full contents, might share these debug packs, inadvertently leaking their private API keys. This issue has been patched in version 0.8.3.

CVSS scores

Score	Version	Source	Vector
8.3High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
gelbphoenix	autocaliweb	< 0.8.3	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/gelbphoenix/autocaliweb/commit/f455051f7c758ae8490186718b73e449f353b702 x_refsource_MISC
https://github.com/gelbphoenix/autocaliweb/releases/tag/v0.8.3 x_refsource_MISC
https://github.com/gelbphoenix/autocaliweb/security/advisories/GHSA-44vp-wgh9-9535 x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-08-13
Last updated: 2025-08-13
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.3%

Probability of exploitation in 30 days

23.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor