CVE-2026-42888: Audiobookshelf Path Traversal Vulnerability

CVE-2026-42888 Overview

CVE-2026-42888 is a path traversal vulnerability [CWE-22] in Audiobookshelf, a self-hosted audiobook and podcast server. The flaw exists in the podcast creation endpoint implemented in server/controllers/PodcastController.js. The endpoint accepts a user-controlled file path without sufficient boundary validation to confirm the path remains within the intended library directory. An attacker can supply a crafted path that escapes the library directory and write podcast-related data to unintended locations on the host file system. The issue affects all versions prior to 2.32.2 and is fixed in version 2.32.2.

Critical Impact
Authenticated network attackers can write outside the intended library directory, potentially affecting the integrity of files on the host running Audiobookshelf.

Affected Products

Audiobookshelf versions prior to 2.32.2
server/controllers/PodcastController.js podcast creation endpoint
Self-hosted audiobook and podcast server deployments

Discovery Timeline

2026-05-11 - CVE-2026-42888 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42888

Vulnerability Analysis

The vulnerability resides in the podcast creation handler within server/controllers/PodcastController.js. The handler accepts a file path parameter supplied by the client and uses it to create podcast resources on disk. The code does not enforce a sufficient boundary check to verify that the resolved path stays inside the configured library directory. As a result, traversal sequences in the user-supplied path can resolve to directories outside the intended root.

Audiobookshelf is typically deployed as a long-running service with file system permissions that allow it to manage media libraries. Any path traversal in a write-capable endpoint extends that file system reach to attacker-chosen locations. The Common Weakness Enumeration classification is [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Root Cause

The root cause is missing canonicalization and containment validation on the file path parameter. Secure handling requires resolving the user input to an absolute path and confirming it has the configured library root as a prefix before any file system operation. The vulnerable code path performs neither check, so relative segments such as ../ propagate through to the underlying file system call.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker with access to the podcast creation endpoint submits a request containing a path that traverses outside the library directory. Because the application process performs the write, the attacker inherits the file system privileges of the Audiobookshelf service account. The impact is limited to integrity, with no direct confidentiality or availability consequences identified in the advisory.

No public proof-of-concept exploit is available for CVE-2026-42888. Technical details are described in the GitHub Security Advisory.

Detection Methods for CVE-2026-42888

Indicators of Compromise

HTTP requests to the Audiobookshelf podcast creation endpoint containing path traversal sequences such as ../ or URL-encoded %2e%2e%2f in path parameters.
Unexpected files or directories created outside the configured Audiobookshelf library root by the service account.
Modifications to system or configuration files with timestamps that align with podcast creation API activity.

Detection Strategies

Inspect Audiobookshelf access logs for POST requests to podcast creation routes carrying suspicious path values referencing absolute paths or parent directory traversal.
Monitor file system events on hosts running Audiobookshelf for writes by the service process to paths outside the library directory.
Apply web application firewall rules that flag traversal patterns on requests destined for /api/podcasts and related endpoints.

Monitoring Recommendations

Enable verbose request logging for the Audiobookshelf API and forward logs to a centralized analytics platform for retention and correlation.
Establish file integrity monitoring on directories adjacent to the library root, including system configuration paths.
Track installed Audiobookshelf versions across hosts and alert when versions prior to 2.32.2 are detected.

How to Mitigate CVE-2026-42888

Immediate Actions Required

Upgrade Audiobookshelf to version 2.32.2 or later, which contains the fix for the path traversal in PodcastController.js.
Restrict network exposure of the Audiobookshelf instance to trusted users by placing it behind authentication proxies or VPN access.
Audit the Audiobookshelf host for unexpected files created by the service account since the deployment date.

Patch Information

The vulnerability is fixed in Audiobookshelf 2.32.2. The maintainers added boundary validation to ensure the user-supplied path resolves within the intended library directory. Operators should pull the updated container image or release artifact and restart the service. Refer to the GitHub Security Advisory GHSA-phch-9734-wrp3 for advisory details.

Workarounds

Limit access to the podcast creation endpoint to trusted administrative users until the patch is applied.
Run Audiobookshelf under a dedicated, low-privilege user account with file system access restricted to the library directory.
Deploy Audiobookshelf within a container or sandbox with read-only mounts for any path outside the media library.

bash

# Configuration example: upgrade Audiobookshelf container to the patched version
docker pull ghcr.io/advplyr/audiobookshelf:2.32.2
docker stop audiobookshelf
docker rm audiobookshelf
docker run -d --name audiobookshelf \
  -v /srv/audiobookshelf/config:/config \
  -v /srv/audiobookshelf/metadata:/metadata \
  -v /srv/audiobookshelf/audiobooks:/audiobooks:ro \
  -p 13378:80 \
  ghcr.io/advplyr/audiobookshelf:2.32.2