CVE-2026-45272

MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIAL_AUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in webserver/loader.py concatenates those names into the generated Python source file auto.py without escaping them. An administrator can submit a crafted SOCIAL_AUTH key name that closes the settings dictionary and injects arbitrary Python statements. The application later executes those statements because SettingsLoader.loadfile imports auto.py as a module, and setting autoreload to true invokes restart_async so a process supervisor restarts the service and triggers the import. Successful exploitation executes commands with the privileges of the application service account and can disclose data, modify files, establish persistence, or disrupt the service. Related authorization and registration vulnerabilities can reduce the effective privilege requirement in a chained attack, but the standalone vulnerability requires administrator access. This issue is fixed in version 3.42.0.

• CWE-94
• CWE-829

• https://github.com/PoxenStudio/mybooks/commit/a1780c98b00566af7da2fc099fe38500efc02e92
• https://github.com/PoxenStudio/mybooks/releases/tag/3.42.0
• https://github.com/PoxenStudio/mybooks/security/advisories/GHSA-4wfr-9gcv-j638

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45264Nextcloud is an open source content collaboration platform. …4.3
• CVE-2026-45266Nextcloud is an open source content collaboration platform. …3.5
• CVE-2026-45267Nextcloud is an open source content collaboration platform. …6.5
• CVE-2026-4527GitLab has remediated an issue in GitLab CE/EE affecting all…6.5
• CVE-2026-45270CI4MS is a CodeIgniter 4-based content management system ske…8.7
• CVE-2026-45271Picotls is a TLS protocol library that allows users select d…5.5
• CVE-2026-45273MyBooks is an ebook management web server also known as Tale…8.7
• CVE-2026-45274MyBooks is anebook management web server also known as Taleb…6.9
• CVE-2026-45275Nextcloud is an open source content collaboration platform. …6.5
• CVE-2026-45277Nextcloud is an open source content collaboration platform. …3.3
• CVE-2026-45278Nextcloud is an open source content collaboration platform. …6.1
• CVE-2026-45279Nextcloud is an open source content collaboration platform. …6.5