CVE-2026-42885: Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existence
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder. This check fails for sibling directories whose names share a common prefix (e.g., /audiobooks vs /audiobooks-private), allowing authenticated users with upload permission to probe file existence outside their authorized library folder boundaries. This vulnerability is fixed in 2.32.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42885?
CVE-2026-42885 is considered a medium severity vulnerability due to its potential for unauthorized access to files outside the intended library folder.
How do I fix CVE-2026-42885?
To fix CVE-2026-42885, update Audiobookshelf to version 2.32.2 or later, where the vulnerability has been addressed.
What versions of Audiobookshelf are affected by CVE-2026-42885?
CVE-2026-42885 affects all versions of Audiobookshelf prior to 2.32.2.
What type of attack can exploit CVE-2026-42885?
CVE-2026-42885 can be exploited through path traversal attacks, allowing access to unintended files within the server's filesystem.
What component of Audiobookshelf is impacted by CVE-2026-42885?
CVE-2026-42885 impacts the POST /api/filesystem/pathexists endpoint within the Audiobookshelf application.