Audiobookshelf versions before 2.33.2 contain a path traversal vulnerability (CWE-22) in the POST /api/filesystem/pathexists endpoint. The endpoint attempts to validate that a resolved file path resides within a designated library folder by using String.startsWith(), which fails when sibling directories share a common prefix (e.g., /audiobooks vs /audiobooks-private). This flaw enables authenticated users with upload permission to check for the existence of files outside their authorized library folder boundaries. The vulnerability is fixed in version 2.33.2.

An authenticated user with upload permissions can probe for the existence of files outside their authorized library folders due to improper pathname validation. This could lead to information disclosure about files and directories outside the intended scope. There is no impact on data integrity or availability. The CVSS score of 4.3 reflects a medium severity with low confidentiality impact and no integrity or availability impact.

Upgrade audiobookshelf to version 2.33.2 or later, where this path traversal vulnerability is fixed. Since the vendor advisory confirms the fix in 2.33.2, applying this update fully mitigates the issue. No additional mitigation steps are indicated.