CVE-2023-47624: Audiobookshelf Arbitrary File Read Vulnerability
Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, any user (regardless of their permissions) may be able to read files from the local file system due to a path traversal in the /hls endpoint. This issue may lead to Information Disclosure. As of time of publication, no patches are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-47624?
CVE-2023-47624 is considered a high severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2023-47624?
To fix CVE-2023-47624, upgrade Audiobookshelf to version 2.4.4 or later.
What is the impact of CVE-2023-47624?
CVE-2023-47624 allows any user to read files from the local file system, leading to potential sensitive information exposure.
Which versions of Audiobookshelf are affected by CVE-2023-47624?
Versions of Audiobookshelf up to and including 2.4.3 are affected by CVE-2023-47624.
Is authentication sufficient to protect against CVE-2023-47624?
No, CVE-2023-47624 can be exploited by any user regardless of their permissions, making authentication ineffective against this vulnerability.