CVE-2024-6781

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
CalibreCalibre7.14.0
calibrecalibre7.14.0

References

Timeline

Published
Aug 6, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-67829.8Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.CVE-2024-67834.8A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prCVE-2024-67849.9Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended informationCVE-2024-67857.1The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, poteCVE-2024-67866.5The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary CVE-2024-67875.9This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). ByCVE-2024-67889.8A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predeCVE-2024-67896.5A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 alloCVE-2024-67906.1Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel DriverCVE-2024-67917.8A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. SucceCVE-2024-67923.5The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.CVE-2024-67939.8A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Succ
CVE-2024-6781: High severity, CVSS 7.5 | Vulnix