# CVE-2026-42888: advplyr Audiobookshelf path traversal in PodcastController

Source: https://junglewise.ai/threats/cve-2026-42888-advplyr-audiobookshelf-path-traversal-in-podcastcontroller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-42888 · Severity: info · CVSS 6.9 · Published 2026-05-11

Audiobookshelf is a self-hosted server used to manage and stream audiobooks and podcasts. A security flaw in the podcast creation feature allows users to bypass folder restrictions and interact with files outside of the designated library directory. This could allow an attacker to perform unauthorized file operations on the host system, potentially compromising the integrity of the server's data.

Technologies: [Advplyr Audiobookshelf](https://junglewise.ai/threats/technologies/audiobookshelf). Vendors: [Advplyr](https://junglewise.ai/threats/vendors/advplyr).

## Quick answers

**Is CVE-2026-42888 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42888 being exploited in the wild.

**How severe is CVE-2026-42888?** Informational severity, with a CVSS score of 6.9, published 11 May 2026.

**Which products and versions are affected?** Advplyr Audiobookshelf <= 2.33.1.

**Is there a fix for CVE-2026-42888?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42888 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42888?** Check whether you run Advplyr Audiobookshelf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in Audiobookshelf within the podcast creation endpoint located at `server/controllers/PodcastController.js`. The application fails to sufficiently validate user-controlled file paths, allowing them to escape the intended library directory boundaries. An attacker can provide a manipulated path that reaches sensitive sinks at lines 61-77 and 127-130 of the controller. Depending on the filesystem permissions of the service account, this could lead to unauthorized reading, writing, or deletion of files on the host system. The issue is resolved in version 2.33.2.

## Affected products

- advplyr Audiobookshelf <= 2.33.1

## Timeline

- 2026-05-03: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD

## References

- [https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-phch-9734-wrp3](https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-phch-9734-wrp3)

## Related threats

- [advplyr Audiobookshelf stored XSS in Login Page](https://junglewise.ai/threats/cve-2026-42887-advplyr-audiobookshelf-stored-xss-in-login-page)
- [advplyr Audiobookshelf DoS via memory exhaustion in backup upload](https://junglewise.ai/threats/cve-2026-42886-advplyr-audiobookshelf-dos-via-memory-exhaustion-in-backup-upload)
- [Audiobookshelf path traversal in filesystem existence check](https://junglewise.ai/threats/cve-2026-42885-audiobookshelf-path-traversal-in-filesystem-existence-check)
- [advplyr Audiobookshelf incorrect authorization in collection endpoints](https://junglewise.ai/threats/cve-2026-42884-advplyr-audiobookshelf-incorrect-authorization-in-collection)
- [advplyr Audiobookshelf incorrect authorization in bulk download endpoint](https://junglewise.ai/threats/cve-2026-42883-advplyr-audiobookshelf-incorrect-authorization-in-bulk-download)