CVE-2026-42883: medium-severity vulnerability in advplyr audiobookshelf
Audiobookshelf: Cross-library file exfiltration via unscoped bulk download endpoint
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.3%
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/libraries/:id/download endpoint validates that the requesting user has access to the library specified in the URL path, but fetches downloadable items solely by attacker-provided IDs without constraining them to that library. An authenticated user with download permission and access to any one library can exfiltrate the full file contents of items belonging to any other library, including libraries they are explicitly denied access to. This vulnerability is fixed in 2.32.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
advplyr · audiobookshelfRelated CVEs — advplyr audiobookshelf
In the same product, most dangerous first.
CVE-2025-25205HIGHRemote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matchingEPSS 4.8%CVE-2026-71209HIGHaudiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path TraversalEPSS 2.2%CVE-2024-35236MEDIUMAudiobookshelf Cross-Site-Scripting vulnerability via crafted ebooksEPSS 0.8%CVE-2023-47624HIGHAudiobookshelf Arbitrary File Read VulnerabilityEPSS 0.8%CVE-2023-47619HIGHAudiobookshelf Server-Side Request Forgery and Arbitrary File Read VulnerabilityEPSS 0.6%CVE-2024-43797MEDIUMPath Traversal in audiobookshelfEPSS 0.5%