CVE-2026-42885

{
  "id": "CVE-2026-42885",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T20:25:44.877",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder. This check fails for sibling directories whose names share a common prefix (e.g., /audiobooks vs /audiobooks-private), allowing authenticated users with upload permission to probe file existence outside their authorized library folder boundaries. This vulnerability is fixed in 2.32.2."
    },
    {
      "lang": "es",
      "value": "Audiobookshelf es un servidor de audiolibros y podcasts autoalojado. Antes de la 2.32.2, el endpoint POST /api/filesystem/pathexists utiliza String.startsWith() para validar que una ruta de archivo resuelta está dentro de una carpeta de biblioteca. Esta comprobación falla para directorios hermanos cuyos nombres comparten un prefijo común (por ejemplo, /audiobooks vs /audiobooks-private), permitiendo a usuarios autenticados con permiso de carga sondear la existencia de archivos fuera de los límites de sus carpetas de biblioteca autorizadas. Esta vulnerabilidad se corrigió en la 2.32.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "advplyr",
          "product": "audiobookshelf",
          "versions": [
            {
              "version": "< 2.33.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-11T20:21:47.166771Z",
          "id": "CVE-2026-42885",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-rhjg-p6cm-38w2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-rhjg-p6cm-38w2",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}