CVE-2026-42885: Advplyr Audiobookshelf

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder. This check fails for sibling directories whose names share a common prefix (e.g., /audiobooks vs /audiobooks-private), allowing authenticated users with upload permission to probe file existence outside their authorized library folder boundaries. This vulnerability is fixed in 2.32.2.

Affected products

• Advplyr Audiobookshelf: before 2.33.2 (fixed in 2.33.2)

Published 2026-05-11. Last modified 2026-06-17.