CVE-2026-42885 - Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existence

Back Back to CVE browser

MEDIUM

Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existence

Published May 11, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.34%

Description

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder. This check fails for sibling directories whose names share a common prefix (e.g., /audiobooks vs /audiobooks-private), allowing authenticated users with upload permission to probe file existence outside their authorized library folder boundaries. This vulnerability is fixed in 2.32.2.

Affected products

Vendor Advplyr Product Audiobookshelf Default
unknown
Affected
- < 2.33.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Advplyr	Audiobookshelf	unknown	Affected < 2.33.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29208
Advisory
https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-rhjg-p6cm-38w2
exploitx_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29208		Advisory
https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-rhjg-p6cm-38w2		exploitx_refsource_CONFIRM

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published May 11, 2026

Updated May 11, 2026

Reserved Apr 30, 2026

Link CVE-2026-42885

CISA Vulnrichment

Updated May 11, 2026

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2026-42885

Red Hat

No data

ENISA EUVD

Assigner GitHub_M

Published May 11, 2026

Updated May 11, 2026

Link EUVD-2026-29208

GitHub

No data