Vulnerabilities

TI-2026-22306 CVE-2026-27963

Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata

MEDIUM 55

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00264 Published 2026-02-26 Fixed in 2.32.0 CWE-79

TI-2026-22315 CVE-2026-27973

Audiobookshelf has Stored XSS in ItemSearchCard.vue via Audiobook Metadata (Search Results on Mobile App)

LOW 21

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00192 Published 2026-02-26 Fixed in 2.12.0, 0.12.0-beta CWE-79

TI-2025-35683 CVE-2025-57800

Audiobookshelf vulnerable to OIDC token exfiltration and account takeover

HIGH 73

Audiobookshelf is an open-source self-hosted audiobook server.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0046 Published 2025-08-22 Fixed in 2.28.0 CWE-523

TI-2025-29079 CVE-2025-46338

Audiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/upload

HIGH 70

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0037 Published 2025-04-29 Fixed in 2.21.0 CWE-79

TI-2025-18874 CVE-2025-25205

Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching

HIGH 75

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.04753 Published 2025-02-12 Fixed in 2.19.1 CWE-202

TI-2024-29391 CVE-2024-43797

Path Traversal in audiobookshelf

MEDIUM 61

audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00546 Published 2024-09-02 Fixed in 2.13.0 CWE-22

TI-2024-23305 CVE-2024-35236

Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks

MEDIUM 55

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00831 Published 2024-05-27 Fixed in 2.10.0 CWE-79

TI-2023-28312 CVE-2023-51665

Audiobookshelf vulnerable to Blind SSRF in `Auth.js`

LOW 33

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00349 Published 2023-12-27 Fixed in 2.7.0 CWE-918

TI-2023-28343 CVE-2023-51697

Audiobookshelf vulnerable to Blind SSRF in `podcastUtils.js`

LOW 33

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00349 Published 2023-12-27 Fixed in 2.7.0 CWE-918

TI-2023-25766 CVE-2023-47624

Audiobookshelf Arbitrary File Read Vulnerability

LOW 34

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00826 Published 2023-12-13 No fix listed CWE-22

TI-2023-25761 CVE-2023-47619

Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability

HIGH 70

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00607 Published 2023-12-13 No fix listed CWE-200

Vulnerabilities

Filters