Vulnerability · Published May 11, 2026 · Assigned by GitHub_M

CVE-2026-42885Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existence

Medium 4.3

In plain English

A medium-severity path traversal in audiobookshelf from advplyr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder. This check fails for sibling directories whose names share a common prefix (e.g., /audiobooks vs /audiobooks-private), allowing authenticated users with upload permission to probe file existence outside their authorized library folder boundaries. This vulnerability is fixed in 2.32.2.

Affected products (as reported)

Vendor	Product	Versions
advplyr	audiobookshelf	< 2.33.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-rhjg-p6cm-38w2 x_refsource_CONFIRM