The vulnerability is present in the background‑image endpoint of Calibre’s ebook viewer web backend. It allows a server‑side request forgery that enables an attacker to send blind GET requests to arbitrary external URLs from within the application, bypassing the restrictions of the ebook sandbox. This can result in the exfiltration of information such as metadata or internal data that the application may access.

All releases of Calibre built by Kovid Goyal before version 9.6.0 are affected. The issue exists in the desktop distribution on any operating system supported by Calibre. Users who open e‑books that contain malicious content that references an arbitrary URL in the background‑image field are at risk.

The listed CVSS base score of 4.8 indicates medium severity. No EPSS score is available and the vulnerability is not in the KEV catalog. Exploitation requires an attacker to supply a malicious e‑book that a user opens in Calibre, which then triggers the vulnerable endpoint. The likely attack vector is user interaction with a crafted e‑book; this inference is drawn from the description of the background‑image endpoint. Because only the vulnerability exists when the application processes user‑supplied content, the probability of exploitation depends on the user opening such a book.