Executive brief
Audiobookshelf is a self-hosted server used to manage and stream audiobooks and podcasts. A security flaw in the podcast creation feature allows users to bypass folder restrictions and interact with files outside of the designated library directory. This could allow an attacker to perform unauthorized file operations on the host system, potentially compromising the integrity of the server's data.
Technical details
A path traversal vulnerability (CWE-22) exists in Audiobookshelf within the podcast creation endpoint located at `server/controllers/PodcastController.js`. The application fails to sufficiently validate user-controlled file paths, allowing them to escape the intended library directory boundaries. An attacker can provide a manipulated path that reaches sensitive sinks at lines 61-77 and 127-130 of the controller. Depending on the filesystem permissions of the service account, this could lead to unauthorized reading, writing, or deletion of files on the host system. The issue is resolved in version 2.33.2.
Affected products
- advplyr Audiobookshelf <= 2.33.1
Timeline
- 2026-05-03: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD