Quick answers
- Is CVE-2026-42885 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42885 being exploited in the wild.
- How severe is CVE-2026-42885?
- Medium severity, with a CVSS score of 4.3, published 11 May 2026.
- Which products and versions are affected?
- Advplyr Audiobookshelf < 2.32.2.
- Is there a fix for CVE-2026-42885?
- A patch was published on 2026-05-11: Fix released in version 2.32.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42885 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-42885?
- Check whether you run Advplyr Audiobookshelf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability exists in the `checkPathExists` handler within `server/controllers/FileSystemController.js`. The application uses `String.startsWith()` to verify that a resolved path remains within the intended library directory. However, this string-based check fails to account for path boundaries, allowing an attacker to access sibling directories that share a common prefix (e.g., `/audiobooks` vs `/audiobooks-private`). An authenticated attacker with `canUpload` permissions can use `../` sequences to resolve paths outside their library; if the resulting string still starts with the library's base path, the check passes. This allows for boolean file existence probing via the `POST /api/filesystem/pathexists` endpoint. The issue is resolved in version 2.32.2 by using a proper path-aware comparison utility.
Affected products
- advplyr Audiobookshelf < 2.32.2
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix released in version 2.32.2