File Path Injection Vulnerability in Audiobookshelf by Audiobookshelf Team
CVE-2026-42888

6.9MEDIUM

Key Information:

Vendor

Advplyr

Status
Audiobookshelf
Vendor
CVE Published:
11 May 2026

What is CVE-2026-42888?

Audiobookshelf, a self-hosted audiobook and podcast server, has a vulnerability in its podcast creation endpoint prior to version 2.32.2. The server fails to validate user-controlled file paths, which could allow attackers to manipulate file paths beyond the intended library directory. This vulnerability poses risks of unauthorized file access, potentially leading to sensitive information exposure. The issue has been addressed in version 2.32.2, and users are strongly advised to upgrade to this version to maintain a secure environment.

Affected Version(s)

audiobookshelf < 2.33.2

References

https://github.com/advplyr/audiobookshelf/security/adviso...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.