Threat Intelligence Database

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0.

audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.

Audiobookshelf versions prior to 2.33.2 contain a path traversal vulnerability in the podcast creation endpoint. This flaw allows an attacker to supply a file path that is not properly validated to remain within the intended library directory. The vulnerability is identified as CWE-22 and has a CVSS 4.0 base score of 6.9, indicating medium severity. The issue is fixed in version 2.33.2.

Audiobookshelf versions prior to 2.33.0 contain a stored cross-site scripting (XSS) vulnerability in the login page. This occurs due to improper sanitization of the authLoginCustomMessage field in the /api/auth-settings endpoint. An attacker with administrative privileges can inject arbitrary HTML or JavaScript code that will be executed when other users visit the login page. This vulnerability has a medium severity rating and a CVSS score of 4.5. The issue is fixed in version 2.33.0.

CVE-2026-42886 is a medium severity vulnerability in advplyr's audiobookshelf prior to version 2.33.2. The POST /api/backups/upload endpoint decompresses a details entry from an uploaded ZIP file entirely into memory without limiting decompressed size. An admin user can exploit this by uploading a crafted ZIP with a highly compressed details entry that expands to consume excessive memory, causing the server process to crash due to out-of-memory conditions. This is a denial-of-service vulnerability related to improper handling of highly compressed data (CWE-409). The issue is fixed in version 2.33.2. No known exploits are reported in the wild.

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder. This check fails for sibling directories whose names share a common prefix (e.g., /audiobooks vs /audiobooks-private), allowing authenticated users with upload permission to probe file existence outside their authorized library folder boundaries. This vulnerability is fixed in 2.32.2.

CVE-2026-42884 is an authorization vulnerability in advplyr's audiobookshelf prior to version 2.32.2. Authenticated users with access to any library can enumerate and read collections from libraries they are not authorized to access, exposing full book metadata. This issue affects the GET /api/collections and GET /api/collections/:id endpoints, which do not properly verify user permissions for each collection's library. The vulnerability has a medium severity with a CVSS score of 4.3. A fix is available in version 2.32.2.

CVE-2026-42883 is an authorization vulnerability in advplyr audiobookshelf versions prior to 2.32.2. The GET /api/libraries/:id/download endpoint improperly validates access to downloadable items, allowing an authenticated user with download permission on any one library to download files from other libraries they should not access. This flaw enables unauthorized exfiltration of audiobook files across libraries. The vulnerability has a CVSS score of 6.5 (medium severity) and is fixed in version 2.32.2.

Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audiobookshelf web application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration. Version 2.32.0 contains a patch for the issue.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-27963#cwe-79

Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 0.12.0-beta of the Audiobookshelf mobile application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers/WebViews, potentially leading to session hijacking, data exfiltration, and unauthorized access to native device APIs. The issue is fixed in audiobookshelf-app version 0.12.0-beta, corresponding to audiobookshelf version 2.12.0.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-27973#cwe-79