Self-Hosted E-Book Library Security

Calibre-Web Security Testing: Default Credentials, File Upload, OPDS Feed, and User Management

📅 July 3, 2026 ⏱ 12 min read 🏷 Calibre-Web, E-Book Library Security, OPDS Feed Security, File Upload Security, User Management Security

Default Credential Testing

# Calibre-Web default credentials: admin / admin123
CALIBRE_URL="https://calibre.example.com"

# Test default credentials
RESPONSE=$(curl -s -X POST "${CALIBRE_URL}/login" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=admin&password=admin123&remember_me=on" \
  -c /tmp/calibre_cookies.txt \
  -L 2>/dev/null)

# Check if authenticated by trying to access admin area
ADMIN_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  "${CALIBRE_URL}/admin" \
  -b /tmp/calibre_cookies.txt 2>/dev/null)

if [ "$ADMIN_STATUS" = "200" ]; then
  echo "DEFAULT CREDENTIALS WORK: admin/admin123"
  # List all users
  curl -s "${CALIBRE_URL}/admin/user" \
    -b /tmp/calibre_cookies.txt 2>/dev/null | \
    grep -oP '(?<=)[^<]+(?=)' | head -20
fi

# Test unauthenticated OPDS catalog access
OPDS_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  "${CALIBRE_URL}/opds" 2>/dev/null)
echo "OPDS catalog status (unauthenticated): ${OPDS_STATUS}"

OPDS Feed Unauthenticated Access

# Calibre-Web OPDS (Open Publication Distribution System) feed
# /opds provides catalog of all books — may be accessible without authentication

CALIBRE_URL="https://calibre.example.com"

# Test OPDS catalog access without credentials
curl -s "${CALIBRE_URL}/opds" 2>/dev/null | \
  python3 -c "
import sys, xml.etree.ElementTree as ET
try:
    root = ET.parse(sys.stdin).getroot()
    ns = {'atom': 'http://www.w3.org/2005/Atom'}
    entries = root.findall('atom:entry', ns)
    print(f'OPDS catalog accessible - {len(entries)} entries')
    for e in entries[:5]:
        title = e.find('atom:title', ns)
        if title is not None:
            print(f'  {title.text}')
except Exception as ex:
    print(f'Error: {ex}')
" 2>/dev/null

# Download a book via OPDS without authentication
# First get the catalog entries
curl -s "${CALIBRE_URL}/opds/new" 2>/dev/null | \
  grep -oP 'href="[^"]+\.epub"' | head -5

Calibre-Web Security Hardening

Security Test	Method	Risk
Default admin/admin123 credentials	POST /login with admin/admin123 — session cookie grants full admin access to user management, library settings, and all stored e-books	Critical
OPDS unauthenticated catalog access	GET /opds without credentials — full e-book catalog browsable and downloadable; all books accessible including any private or sensitive documents stored in the library	High
User enumeration via /admin/user	Authenticated GET /admin/user — lists all registered users with usernames, email addresses, and permission levels	Medium
Open user registration when Allow Registration enabled	POST /register — any visitor can create an account and gain access to the e-book library and any reader-level features	High
Malicious e-book upload to Calibre conversion pipeline	POST /upload with crafted EPUB/MOBI file — file is processed by Calibre conversion tools server-side; malformed files can trigger vulnerabilities in parsing libraries	Medium
Direct access to metadata.db or app.db	GET /metadata.db or /app.db if web server misconfigured — SQLite database containing all book metadata and user account hashes with email addresses	High