Audiobookshelf CVE-2026-42886

Exploitation requires an authenticated admin user account and network access to the POST /api/backups/upload endpoint. The endpoint is exposed via the default HTTP/HTTPS interface of Audiobookshelf and accepts ZIP file uploads in the backup functionality. No special server configuration or non-default features are required-the flaw exists in the core backup restoration logic. The attack is limited to users with admin privileges; standard users cannot access or exploit the vulnerable endpoint. Successful exploitation crashes only the application process, not the underlying host operating system, assuming the system has adequate swap or OOM killer configured.

This vulnerability presents moderate real-world risk with important context: CVSS score of 4.9 reflects high attack complexity due to the PR:H (high privilege) requirement-only admin users can exploit this. The network-accessible endpoint (AV:N, AC:L) and guaranteed denial-of-service impact (A:H) are significant, but privilege escalation is a prerequisite. EPSS and KEV status are not provided, but the public GitHub advisory and clearly described exploitation path suggest credible risk. The primary threat model is a compromised admin account or insider threat, not unauthenticated remote exploitation. Organizations with strict admin access controls face lower risk; those with delegated admin roles or shared credentials face higher exposure. No compensating controls can fully mitigate this without patching, as the flaw is in core deserialization logic.

An administrator (or attacker with stolen admin credentials) logs into Audiobookshelf and navigates to the backup upload feature. They upload a malicious .audiobookshelf ZIP file containing a details entry that is 50 megabytes compressed but expands to 10 gigabytes when decompressed. The server begins extracting the ZIP without size validation, memory usage spikes uncontrollably, and the Node.js process crashes within seconds, making the audiobook server unavailable until manually restarted.