A flaw in the calibre Content Server allows an authenticated user to inject arbitrary HTTP response headers through an unsanitized content_disposition query parameter on the /get/ and /data-files/get/ endpoints. This can lead to HTTP header manipulation, potentially compromising the integrity of responses. The weakness is categorized as CWE‑113. The issue can be triggered by an authenticated victim clicking a crafted link, making it potentially exploitable in victim‑based scenarios.

All users running calibre Content Server versions earlier than 9.4.0 with authentication enabled are affected. The vulnerability applies to every installation of the content server that exposes the default "content_disposition" parameter and has any form of user authentication configured. These deployments are produced by the vendor kovidgoyal and use the product calibre.

The vulnerability has a CVSS v3.1 score of 6.4, indicating a moderate severity. Current EPSS data shows an exploitation probability of less than 1 %, suggesting a low likelihood of broad exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session and manipulation of the content_disposition parameter, which can be achieved via a crafted URL.