External risk intelligence

MyBooks Web Server Code Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-45272

MyBooks is a web-based ebook management server designed to be accessed over a network. As a web application that typically hosts content for users, it is commonly deployed in environments where it is reachable via a browser, making it likely to be exposed as a web service in many deployment scenarios.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in MyBooks, a personal ebook management web server, that could allow an administrator to inject and execute arbitrary Python code. This could lead to unauthorized data access, modification, or service disruption. The main concern is confirming relevance and exposure within your environment.

Administrator can run any code on the server.
Affects ebook management web server, potentially data.
Confirm if this ebook server is in use.

Attack Path

How an attacker could exploit the issue

An administrator can leverage this vulnerability by submitting a specially crafted key name to the AdminSettings.post handler. This malicious input is not properly validated for quotes or newlines, allowing it to break out of the expected settings structure and inject arbitrary Python code. The application then unintentionally executes this injected code when it loads the settings, potentially leading to unauthorized command execution with the application's privileges.

Requires administrator access.
Inject arbitrary Python code via crafted key name.
Command execution with service account privileges.

Live Threat

Current exploitation, exposure, and threat context

A security flaw in MyBooks could allow an authenticated administrator to execute arbitrary Python code on the server. This occurs when a specially crafted administrator key name is submitted, which can then be injected into the server's auto-generated Python configuration file. When this configuration is loaded or the service is restarted, the injected code is executed with the privileges of the application's service account.

System data and files could be affected.
Arbitrary commands could be executed by an attacker.
Service disruption or data disclosure may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MyBooks (Talebook) web server, specifically versions prior to 3.42.0, contains a critical vulnerability that allows for arbitrary Python code execution via crafted administrator settings. Ownership of this issue likely falls to the application or platform team responsible for the MyBooks deployment, who must first identify all instances of the affected software, confirm their exposure and business criticality, and then coordinate remediation.

Application owners should manage remediation.
Verify all MyBooks instances and exposure.
Plan remediation or deploy vendor fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MyBooks or Talebook?

MyBooks, also known as Talebook, is a self-hosted web server designed for managing personal ebook collections. It provides an interface for users to organize and access their digital libraries over a network. Because it functions as a web-based service, it typically runs on infrastructure that allows remote access via a browser.

What is the vulnerability in CVE-2026-45272?

This is a code injection vulnerability, specifically categorized as CWE-94. The software fails to sanitize input in its administrative settings. When an administrator submits certain configuration values, the server incorrectly interprets them as executable Python code instead of plain text, allowing that code to run directly on the underlying system.

How is this vulnerability triggered?

An authenticated administrator must submit a specially crafted key name into the settings interface. The application then writes this malicious input into a configuration file. The bug is triggered when the system reloads this file or restarts. Simply accessing the site or viewing settings without the specific malicious input does not activate the flaw.

Why does Halo Surface Signal categorize this as external?

Halo Surface Signal labels this as external because MyBooks is a network-accessible web application. Since it is designed to be reachable via a browser, it is often exposed to broader network environments. This increases the potential for unauthorized administrative access, which is the primary requirement for exploiting this vulnerability.

Do I need to update MyBooks?

Yes, if you are running any version prior to 3.42.0, you should plan to upgrade. The first step is to identify all instances of MyBooks within your environment to understand where this software is hosted. Once identified, coordinating the update to version 3.42.0 or later is the necessary action to remediate the flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.