CVE-2025-7404: 
Python vulnerability analysis and mitigation

CVE-2025-7404 is an OS Command Injection vulnerability discovered in Calibre Web version 0.6.24 (Nicolette) and Autocaliweb versions 0.7.0 before 0.7.1. The vulnerability was discovered by Johan Giraldo from Fluid Attacks' Offensive Team on July 7, 2025, and was publicly disclosed on July 24, 2025. The vulnerability allows authenticated administrators to perform blind OS command injection through improper neutralization of special elements (Fluid Attacks).

The vulnerability exists in the /admin/ajaxconfig endpoint, which allows authenticated administrators to configure system settings via POST requests. The vulnerability specifically occurs in the 'config_rarfile_location' parameter, which is validated by the 'check_unrar()' helper function. While the function checks for path existence using os.path.exists(), it fails to properly validate the path contents before passing them to subprocess execution functions. This allows execution of arbitrary binaries through absolute paths, though without the ability to pass parameters. The vulnerability has been assigned a CVSS v4.0 base score of 5.9 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N (Fluid Attacks).

The vulnerability allows authenticated administrators to execute arbitrary binaries on the system using absolute paths. While parameter passing is not possible, the attacker can trigger default behaviors of system binaries, potentially affecting system integrity and availability. For example, an attacker could execute system commands like /sbin/reboot to force a system restart. Due to the blind nature of the injection, data exfiltration capabilities are limited (Fluid Attacks).

For Autocaliweb users, the vulnerability has been patched in version 0.7.1, and users should upgrade to this version. However, there is currently no patch available for the Calibre Web project. Users of Calibre Web should consider implementing additional access controls and monitoring of administrator actions until a patch is released (Fluid Attacks).