CVE-2026-42885CWE-22

Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existence

Medium · published May 11, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
26.4
In the wild
Unconfirmed
What it is

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder. This check fails for sibling directories whose names share a common prefix (e.g., /audiobooks vs /audiobooks-private), allowing authenticated users with upload permission to probe file existence outside their authorized library folder boundaries. This vulnerability is fixed in 2.32.2.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-11T19:52Z
EPSS history
Timeline
  • 11 MAY 19:52Z
    Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existence
    cvelistv5