Audiobookshelf EUVD-2026-29208

Exploitation requires three specific conditions: (1) valid Audiobookshelf user credentials with upload permission granted on at least one library folder, (2) knowledge or guessing of sibling directory names that share a common prefix with the user's authorized library (e.g., /audiobooks and /audiobooks-private), and (3) ability to send POST requests to the /api/filesystem/pathexists endpoint. The vulnerability does not affect deployments where all library folders have distinct non-overlapping names, nor does it affect users without upload permissions. Default Audiobookshelf configurations are vulnerable if multiple libraries are defined with prefix-sharing names, which is a realistic scenario in multi-user installations.

This vulnerability presents limited real-world risk despite authentication requirements. The CVSS score of 4.3 (Low-to-Moderate) with network vector, low complexity, and low privileges required reflects accurate severity: the attack requires valid Audiobookshelf credentials with upload permission, but the impact is restricted to confidentiality (information disclosure via file existence checks). The EPSS score and active exploitation status are not provided, but the nature of the vulnerability (file existence probing rather than file read/write/execute) and requirement for authenticated access suggest this is a targeted reconnaissance vector rather than a critical asset compromise risk. Organizations relying on Audiobookshelf for sensitive audio content segregation should prioritize patching, but this does not rank among critical vulnerabilities requiring emergency response. The vulnerability's impact is further limited by CVSS Scope=Unchanged (S:U), indicating no cross-user privilege escalation.

An authenticated user with upload permissions in the /audiobooks library constructs POST requests to /api/filesystem/pathexists with paths like /audiobooks-private/sensitive-content to determine whether certain files exist in a sibling directory. By systematically probing common directory names and paths, the attacker can map the server's file structure outside their authorized scope, potentially identifying sensitive audio files or backup locations they should not have access to enumerate.