What is the CVSS score of CVE-2026-42885?

CVE-2026-42885 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42885?

Yes, a patch is available for CVE-2026-42885. Update the affected software to the latest version immediately.

Audiobookshelf CVE-2026-42885

EUVD-2026-29208 MEDIUM

Path Traversal (CWE-22)

2026-05-11 GitHub_M

Path Traversal Audiobookshelf

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 11, 2026 - 21:03 EUVD

Analysis Generated

May 11, 2026 - 20:31 vuln.today

CVE Published

May 11, 2026 - 19:52 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder. This check fails for sibling directories whose names share a common prefix (e.g., /audiobooks vs /audiobooks-private), allowing authenticated users with upload permission to probe file existence outside their authorized library folder boundaries. This vulnerability is fixed in 2.32.2.

AnalysisAI

Authenticated users with upload permission in Audiobookshelf prior to 2.32.2 can enumerate files outside their authorized library folder through a path traversal vulnerability in the POST /api/filesystem/pathexists endpoint. The vulnerability exploits a weak String.startsWith() validation that fails to distinguish between sibling directories with shared prefixes (e.g., /audiobooks and /audiobooks-private), allowing information disclosure about file existence across library boundaries despite authentication requirements. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Audiobookshelf uses String.startsWith() to validate that resolved file paths remain within a user's authorized library directory, a common but flawed approach to path boundary checking. This method fails when directory names share prefixes - for example, if a user is authorized for /audiobooks, the path /audiobooks-private would pass validation because it starts with /audiobooks, even though the real path is outside the intended boundary. This is a classic instance of CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where insufficient canonicalization and validation of file path input allows directory traversal. The vulnerability is specific to the POST /api/filesystem/pathexists endpoint, which appears to be used to check file existence without enforcing proper scope isolation.

RemediationAI

Upgrade Audiobookshelf to version 2.32.2 or later, which corrects the path validation logic to properly check for path boundaries without relying on prefix matching. If immediate upgrade is not feasible, restrict upload permission to trusted users only and monitor POST requests to /api/filesystem/pathexists for unusual path patterns (e.g., requests probing sibling directories or parent paths). Note that this compensating control does not eliminate the vulnerability but reduces the pool of potential attackers and may increase detection likelihood. The patch is available from the official Audiobookshelf repository and should be deployed after testing in a non-production environment to ensure compatibility with custom library configurations.