CVE-2026-42888 — Audiobookshelf: Path Traversal vulnerability in the audiobookshelf project

CVE-2026-42888

Audiobookshelf: Path Traversal vulnerability in the audiobookshelf project PUBLISHED

Description (CNA)

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the podcast creation endpoint at server/controllers/PodcastController.js accepts a user-controlled file path without sufficient boundary validation to ensure it remains within the intended library directory. This vulnerability is fixed in 2.32.2.

Affected (CNA)

Vendor / product	Versions
advplyr / audiobookshelf	affected < 2.33.2

CWE

CWE-22

References

https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-phch-9734-wrp3

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.