# Calibre-Web 0.6.27 — V 0.6.27 - Ludmila

- Product: Calibre-Web (https://whatsnew.fyi/product/calibre-web)
- Vendor: Calibre-Web
- Date: 2026-08-08
- Version: 0.6.27
- Original notes: https://github.com/janeczku/calibre-web/releases/tag/0.6.27
- Permalink: https://whatsnew.fyi/product/calibre-web/releases/0.6.27

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — MOBI files now support metadata extraction on upload
- **added** — Reverse proxy login with shared secret header implemented
- **fixed** — Cover path is now selected based on the correct setting instead of the presence of split_path
- **fixed** — Title sort with "l'" now works correctly in French
- **fixed** — Exclamation marks removed from HTML strings
- **fixed** — Kobo sync behind reverse proxy now works correctly with library_sync URL rewritten in init response
- **fixed** — Add-to-shelves dropdown menu now renders correctly
- **fixed** — Kobo "Sync to last page read" popup no longer appears repeatedly due to float/int mismatch
- **fixed** — Kobo "Return to last page read" popup when ProgressPercent is 0 now handled correctly
- **fixed** — Kobo PUT /state response now includes PriorityTimestamp
- **fixed** — Downloaded filenames now use native UTF-8 encoding for browsers that support it
- **fixed** — Series list view now sorts by the correct sort field, preventing incorrect article-inclusive sorting
- **fixed** — natsort is now used for comic cover page detection when available
- **fixed** — Login failure now returns HTTP 401
- **fixed** — Registration and password reset emails are now sent in the recipient's language
- **fixed** — Crash when User-Agent header is missing is now fixed
- **fixed** — Infinite scroll now triggers correctly on mobile browsers
- **fixed** — Case-insensitive duplicate tags are no longer created
- **fixed** — UNIQUE constraint crash on transliteration-identical authors is now fixed
- **security** — XSS payload in book comments imported via Calibre is now sanitized before display

!Attention! For this update nh3 has to be installed !Attention!

**New features:**
- MOBI files now support metadata extraction on upload
- Reverse proxy login with shared secret header implemented

**Bug Fixes:**
- Cover path is now selected based on the correct setting instead of the presence of `split_path` (#3527)
- Title sort with "l'" now works correctly in French
- Exclamation marks removed from HTML strings
- Kobo sync behind reverse proxy now works correctly: `library_sync` URL is rewritten in init response
- Add-to-shelves dropdown menu now renders correctly
- Kobo "Sync to last page read" popup no longer appears repeatedly due to float/int mismatch
- Kobo "Return to last page read" popup when ProgressPercent is 0 now handled correctly
- Kobo PUT `/state` response now includes PriorityTimestamp
- Downloaded filenames now use native UTF-8 encoding for browsers that support it
- Series list view now sorts by the correct sort field, preventing incorrect article-inclusive sorting (#3583)
- natsort is now used for comic cover page detection when available
- Login failure now returns HTTP 401
- Registration and password reset emails are now sent in the recipient's language
- Crash when User-Agent header is missing is now fixed
- Infinite scroll now triggers correctly on mobile browsers (#3664)
- Case-insensitive duplicate tags are no longer created
- UNIQUE constraint crash on transliteration-identical authors is now fixed (#3403, #3170)
- Caliblur eReader toolbar dropdown overflow is now fixed
- Unauthenticated OPDS requests no longer cause an AttributeError (#3592)
- Metadata search no longer crashes when ComicVine or Douban return no results (#3606)
- Kobo API results are now correctly filtered
- kepubify path is now properly cleared when removed
- OPDS `atom:updated` now reflects the last modification date instead of date added
- Staged temporary download files are now cleaned up after the response is sent
- Cover sibling files are no longer created on every book download (`--dont-save-cover`)
- lubimyczytać.pl metadata provider is now working correctly
- Error handling for series display and book/user table sorting is now improved
- Book conversion format validation now works correctly with HTML-based formats
- Circular import issue in format conversion is now fixed
- File upload temp folder is now instance-specific
- Reverse proxy login now shows user warning when enabled
- Rate limiter reset for reverse proxy header login is now deactivated
- Reverse proxy login now restricts IP addresses and uses shared secret header
- Dialog size of Server side file picker is now limited
- Search metadata provider selection has been improved
- GDrive file type condition error is now fixed
- OPDS error handling for unauthenticated requests is improved

** Security **
- XSS payload in book comments imported via Calibre is now sanitized before display (reported by @Nozomu Sasaki)
- External binary names (e.g. unrar) are now restricted to prevent remote command execution (CVE-2025-7404)
- ReDoS vulnerability in whitespace stripping is now fixed (CVE-2025-6998)
- Stored XSS via author names in `author.html` is now prevented
- Magic link login flow is now hardened against misuse
- SQL injection via the database path parameter is now prevented
- LDAP injection in `bind_user` / `get_object_details` is now prevented
- XXE injection in EPUB, FB2 and Goodreads API parsing is now prevented
- IDOR in Kobo tokens is now fixed
- OAuth account relinking by unauthorized users is now prevented
- Shelf editing is now restricted to users with appropriate permissions
- Unauthorized access to book files via `/show/` is now prevented
- Server credentials are no longer exposed in debug output
- Encryption key file now has restrictive file permissions (0o600)
- CSP nonce entropy increased from 32 to 128 bits
- SQL comment column names are now properly escaped
- A Format check during conversion

_[Truncated at 4000 characters — full notes: https://github.com/janeczku/calibre-web/releases/tag/0.6.27]_