CVE-2026-42888 — Audiobookshelf: Path Traversal vulnerability in the audiobookshelf project
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the podcast creation endpoint at server/controllers/PodcastController.js accepts a user-controlled…
Published: 2026-05-11 · CVSS: 6.9 · CVSS 4.0
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the podcast creation endpoint at server/controllers/PodcastController.js accepts a user-controlled file path without sufficient boundary validation to ensure it remains within the intended library directory. This vulnerability is fixed in 2.32.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7