What is CVE-2025-55165?

CVE-2025-55165 is a high-severity vulnerability in Gelbphoenix Autocaliweb, classified under Information Disclosure. CVSS score: 8.2/10. Published 2025-08-12.

How severe is CVE-2025-55165?

High severity. CVSS v3 base score is 8.2 out of 10.

Information disclosure in Gelbphoenix Autocaliweb

CVE-2025-55165

Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the to_dict() method, used to serialize configuration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the full contents, might share these debug packs, inadvertently leaking their private API keys. This issue has been patched in version 0.8.3.

Vulnerability class: Information Disclosure

EPSS: 0.002 (9.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

Affected products

Gelbphoenix Autocaliweb — versions < 0.8.3

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-55165?: CVE-2025-55165 is a high-severity vulnerability in Gelbphoenix Autocaliweb, classified under Information Disclosure. CVSS score: 8.2/10. Published 2025-08-12.
How severe is CVE-2025-55165?: High severity. CVSS v3 base score is 8.2 out of 10.