Is there a patch available for CVE-2026-42888?

Yes, a patch is available for CVE-2026-42888. Update the affected software to the latest version immediately.

Audiobookshelf CVE-2026-42888

Q: What is the CVSS score of CVE-2026-42888?

CVE-2026-42888 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29297 MEDIUM

Path Traversal (CWE-22)

2026-05-11 GitHub_M

Path Traversal Audiobookshelf Advplyr

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Podcast creation is a write operation likely requiring at least user-level auth (PR:L); only limited integrity impact applies with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:37 vuln.today

Patch available

May 11, 2026 - 22:18 EUVD

CVSS changed

May 11, 2026 - 21:22 NVD

6.9 (MEDIUM)

CVE Published

May 11, 2026 - 20:16 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the podcast creation endpoint at server/controllers/PodcastController.js accepts a user-controlled file path without sufficient boundary validation to ensure it remains within the intended library directory. This vulnerability is fixed in 2.32.2.

AnalysisAI

Path traversal in Audiobookshelf's podcast creation endpoint allows attackers to write files outside the intended library directory by supplying a crafted file path. Affected versions are all releases prior to 2.32.2 (per CVE) or 2.33.2 (per EUVD - see confidence notes), with the vulnerable code located in server/controllers/PodcastController.js. No public exploit code has been identified and CISA KEV has not flagged active exploitation, but SSVC marks the attack as automatable, meaning scripted mass-scanning is feasible once a reliable exploit exists.

Technical ContextAI

Audiobookshelf (CPE: cpe:2.3:a:advplyr:audiobookshelf:*:*:*:*:*:*:*:*) is a Node.js self-hosted media server for audiobooks and podcasts. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal flaw. The podcast creation HTTP endpoint accepts a caller-supplied file path parameter and performs insufficient boundary validation - it fails to canonicalize or jail the path within the configured library directory before acting on it. A crafted payload containing sequences such as '../' or absolute paths can therefore cause the server to write or interact with files anywhere the Node.js process has filesystem access, outside the intended media root.

RemediationAI

Upgrade Audiobookshelf to version 2.32.2 or later; the EUVD record suggests 2.33.2 may represent a further fix - consult the vendor security advisory at https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-phch-9734-wrp3 to confirm the authoritative patched release before upgrading. If immediate patching is not possible, restrict network access to the Audiobookshelf instance so only trusted users can reach the podcast creation API endpoint - placing it behind a VPN or an authenticated reverse proxy eliminates the network vector for unauthenticated exploitation. Additionally, running the Audiobookshelf process under a dedicated low-privilege OS user with filesystem permissions scoped strictly to the intended media library directory limits the blast radius of any successful path traversal to that directory tree, preventing writes to sensitive system paths.