Audiobookshelf CVE-2026-42888

Exploitation requires the ability to reach the podcast creation API endpoint in server/controllers/PodcastController.js over the network. The supplied CVSS 4.0 vector specifies PR:N (no authentication required), but this analyst notes that podcast creation is a write operation typically gated behind authentication in self-hosted media servers - if the endpoint does enforce authentication, a valid user account (PR:L) would be required. Administrators should verify whether their deployment exposes the podcast API to unauthenticated callers. Limiting factors include: the product is self-hosted and not inherently internet-facing (many deployments are LAN or VPN-only); the integrity impact is scoped to files writable by the server process; and no availability or confidentiality impact is indicated by CVSS metrics.

The CVSS 4.0 base score of 6.9 reflects a network-accessible, low-complexity, no-privileges-required attack with limited integrity impact and no confidentiality or availability impact. However, the PR:N assignment warrants scrutiny - podcast creation is a state-modifying operation that typically requires authentication on a self-hosted server, and this analyst assesses PR:L as more likely (see assessed vector). EPSS sits at 0.05% (14th percentile), indicating very low current exploitation probability. SSVC marks exploitation as 'none' observed, but automatable, meaning the attack pattern is straightforward enough to script. KEV status is not triggered, and no POC has been identified. Taken together, this is a real but low-urgency finding: the integrity impact is limited (VI:L, no data exfiltration or availability), the product has a narrow self-hosted deployment footprint, and no exploitation activity has been reported. Patching is the appropriate response; emergency out-of-band remediation is not warranted absent KEV or POC confirmation.

An attacker who can reach the Audiobookshelf podcast creation endpoint sends an HTTP request containing a crafted file path - for example, using '../' sequences to escape the library root - causing the server to write an attacker-controlled file to an arbitrary location writable by the Node.js process. No public proof-of-concept code is known at time of analysis. The SSVC 'automatable' flag indicates that once a reliable exploit is developed, scripted scanning across self-hosted instances exposed to the internet would be feasible.