CVE-2026-42888: falha de média gravidade em advplyr audiobookshelf
Audiobookshelf: Path Traversal vulnerability in the audiobookshelf project
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.3%
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the podcast creation endpoint at server/controllers/PodcastController.js accepts a user-controlled file path without sufficient boundary validation to ensure it remains within the intended library directory. This vulnerability is fixed in 2.32.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
advplyr · audiobookshelfCVEs relacionadas — advplyr audiobookshelf
No mesmo produto, das mais perigosas para as menos.
CVE-2025-25205HIGHRemote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matchingEPSS 4.8%CVE-2026-71209HIGHaudiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path TraversalEPSS 2.2%CVE-2024-35236MEDIUMAudiobookshelf Cross-Site-Scripting vulnerability via crafted ebooksEPSS 0.8%CVE-2023-47624HIGHAudiobookshelf Arbitrary File Read VulnerabilityEPSS 0.8%CVE-2023-47619HIGHAudiobookshelf Server-Side Request Forgery and Arbitrary File Read VulnerabilityEPSS 0.6%CVE-2024-43797MEDIUMPath Traversal in audiobookshelfEPSS 0.5%