CVE-2026-42885 Overview
CVE-2026-42885 is a path traversal vulnerability [CWE-22] in Audiobookshelf, a self-hosted audiobook and podcast server. The flaw affects the POST /api/filesystem/pathexists endpoint in versions prior to 2.32.2. The endpoint uses JavaScript's String.startsWith() method to validate that a resolved file path falls within an authorized library folder. This validation logic fails when sibling directories share a common prefix, such as /audiobooks and /audiobooks-private. Authenticated users with upload permission can exploit this weakness to probe for the existence of files outside their authorized library boundaries. The issue is fixed in version 2.32.2.
Critical Impact
Authenticated users with upload privileges can enumerate file existence outside their authorized library scope, leaking information about the underlying filesystem structure.
Affected Products
- Audiobookshelf versions prior to 2.32.2
- Self-hosted Audiobookshelf instances exposing the /api/filesystem/pathexists endpoint
- Deployments with multiple library folders sharing common path prefixes
Discovery Timeline
- 2026-05-11 - CVE-2026-42885 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-42885
Vulnerability Analysis
The vulnerability resides in the path validation logic of the POST /api/filesystem/pathexists endpoint. Audiobookshelf uses the JavaScript String.startsWith() method to verify that a resolved path is contained within an allowed library folder. String prefix matching does not enforce directory boundaries. A path such as /audiobooks-private/secret.mp3 returns true when checked against the prefix /audiobooks, even though the two directories are siblings rather than parent and child.
An authenticated user with upload permission can submit arbitrary paths to the endpoint. The server responds with whether the resolved path exists on disk. This grants the attacker an oracle for probing files across the host filesystem, limited only by paths that share a textual prefix with an authorized library folder.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The check resolvedPath.startsWith(libraryPath) treats path strings as opaque sequences of characters instead of hierarchical path components. The validator does not append a trailing separator or use a path-aware containment check such as path.relative() followed by traversal validation. Sibling directories that lexically extend the library prefix bypass the boundary check entirely.
Attack Vector
Exploitation requires network access to the Audiobookshelf instance and an authenticated account with upload permission. The attacker sends crafted POST requests to /api/filesystem/pathexists containing paths that share a common prefix with a configured library folder. By iterating over candidate paths, the attacker enumerates the presence of files and directories outside the authorized scope. The vulnerability does not allow file read or write operations. The impact is confined to confidentiality through filesystem existence disclosure. See the GitHub Security Advisory for additional technical details.
Detection Methods for CVE-2026-42885
Indicators of Compromise
- Unusual volume of POST /api/filesystem/pathexists requests from a single authenticated session
- Requests containing paths that lexically extend library folder names with additional characters before a separator (e.g., /audiobooks-private/...)
- Repeated probing patterns where path strings differ by small increments, indicating filesystem enumeration
Detection Strategies
- Enable access logging on the reverse proxy in front of Audiobookshelf and parse request bodies for /api/filesystem/pathexists calls
- Build a baseline of legitimate path arguments per user and alert on requests whose resolved paths do not begin with a library folder followed by a path separator
- Correlate authenticated upload-permission accounts with elevated request rates against the filesystem endpoint
Monitoring Recommendations
- Forward Audiobookshelf application logs to a centralized log platform for retention and search
- Alert on HTTP 200 responses to /api/filesystem/pathexists containing path values referencing directories outside configured libraries
- Review user accounts with upload permission and audit their activity against the filesystem API
How to Mitigate CVE-2026-42885
Immediate Actions Required
- Upgrade Audiobookshelf to version 2.32.2 or later, which contains the corrected path validation logic
- Audit accounts with upload permission and revoke access for users that do not require it
- Restrict network exposure of the Audiobookshelf instance to trusted networks or place it behind an authenticating reverse proxy
Patch Information
The vendor released version 2.32.2 with a corrected containment check that enforces directory boundaries rather than string prefixes. Administrators should update through their normal deployment process, whether Docker image, native package, or source build. Refer to the GitHub Security Advisory GHSA-rhjg-p6cm-38w2 for the full fix details.
Workarounds
- Rename library folders so no two share a common textual prefix (e.g., use /media/public-audiobooks and /media/private-archive instead of /audiobooks and /audiobooks-private)
- Block access to /api/filesystem/pathexists at the reverse proxy for users that do not require upload functionality
- Run Audiobookshelf in a container or chroot environment so probing cannot reveal sensitive host paths
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
