CVE-2026-27810 Overview
CVE-2026-27810 is an HTTP Response Header Injection vulnerability affecting the calibre Content Server, a component of the popular cross-platform e-book management application. The vulnerability exists in the /get/ and /data-files/get/ endpoints where the content_disposition query parameter is not properly sanitized, allowing authenticated users to inject arbitrary HTTP headers into server responses.
This flaw enables attackers to manipulate HTTP response headers, potentially leading to cache poisoning, session fixation, cross-site scripting via header injection, or other web-based attacks. The vulnerability can be exploited directly by any authenticated user or through social engineering by tricking an authenticated victim into clicking a maliciously crafted link.
Critical Impact
Authenticated attackers can inject arbitrary HTTP headers into server responses, potentially enabling cache poisoning, session hijacking, or cross-site scripting attacks against other authenticated users.
Affected Products
- calibre-ebook calibre versions prior to 9.4.0
Discovery Timeline
- 2026-02-27 - CVE-2026-27810 published to NVD
- 2026-03-04 - Last updated in NVD database
Technical Details for CVE-2026-27810
Vulnerability Analysis
This vulnerability falls under CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers), commonly known as HTTP Response Splitting or Header Injection. The calibre Content Server fails to sanitize user-supplied input in the content_disposition query parameter before incorporating it into HTTP response headers.
When a user makes a request to the /get/ or /data-files/get/ endpoints, the server uses the content_disposition parameter to set the Content-Disposition response header. Without proper sanitization, an attacker can inject carriage return and line feed (CRLF) characters followed by additional headers or even response body content.
The network-based attack vector with low complexity makes this vulnerability accessible to any authenticated user. While authentication is required, the scope is changed (S:C in the CVSS vector), meaning the vulnerability can impact resources beyond the vulnerable component's security scope—potentially affecting other users or the integrity of cached responses.
Root Cause
The root cause is insufficient input validation and sanitization of the content_disposition query parameter. The server directly incorporates user-controlled data into HTTP response headers without properly encoding or rejecting CRLF sequences (\r\n). This allows attackers to terminate the current header and inject arbitrary additional headers.
Attack Vector
The attack exploits the network-accessible Content Server endpoints that handle file downloads. An attacker with valid authentication credentials can craft a malicious URL containing CRLF sequences in the content_disposition parameter. When the server processes this request, it splits the response headers at the injected CRLF sequences, allowing the attacker to:
- Inject arbitrary HTTP response headers
- Potentially set malicious cookies
- Poison web caches with crafted content
- Enable cross-site scripting through injected headers
- Perform session fixation attacks
The vulnerability can also be weaponized through social engineering by sending a crafted link to an authenticated victim, making them unknowingly trigger the header injection.
The vulnerability manifests when processing the content_disposition parameter in the /get/ and /data-files/get/ endpoints. See the GitHub Security Advisory for complete technical details.
Detection Methods for CVE-2026-27810
Indicators of Compromise
- Unusual HTTP requests to /get/ or /data-files/get/ endpoints containing encoded CRLF sequences (%0d%0a or %0D%0A) in query parameters
- Server access logs showing content_disposition parameters with URL-encoded special characters
- Unexpected Set-Cookie headers or other anomalous headers in responses from the calibre Content Server
Detection Strategies
- Deploy web application firewall (WAF) rules to detect and block CRLF injection attempts in query parameters
- Implement log analysis rules to identify requests containing %0d, %0a, \r, or \n characters in the content_disposition parameter
- Monitor for unusual patterns of requests to the affected endpoints, especially those with encoded special characters
- Enable detailed request logging on the calibre Content Server to capture full query strings for forensic analysis
Monitoring Recommendations
- Configure alerting for HTTP requests containing CRLF sequences targeting calibre Content Server endpoints
- Implement anomaly detection for unusual response header patterns from the Content Server
- Monitor authentication logs for accounts making suspicious requests to the vulnerable endpoints
- Review web server logs regularly for evidence of header injection attempts
How to Mitigate CVE-2026-27810
Immediate Actions Required
- Upgrade calibre to version 9.4.0 or later immediately
- If immediate upgrade is not possible, disable the calibre Content Server until patching is complete
- Review access logs for signs of exploitation attempts
- Audit authenticated user accounts for any suspicious activity
Patch Information
The vulnerability has been fixed in calibre version 9.4.0. Users should upgrade to this version or later to remediate the vulnerability. The patch properly sanitizes the content_disposition query parameter to prevent CRLF injection. For more information, see the calibre security advisory on GitHub.
Workarounds
- Disable the calibre Content Server if it is not required for your use case
- Place the Content Server behind a reverse proxy with WAF capabilities that can filter CRLF injection attempts
- Restrict access to the Content Server to trusted networks only using firewall rules
- Implement additional authentication layers or access controls to limit exposure
# Example: Disable calibre Content Server
# In calibre preferences, navigate to:
# Preferences > Sharing over the net > Stop server
# Or via command line, avoid starting the content server:
calibre-server --stop
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
