CVE-2024-43797

audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries (or access only the ones they have permission to). However, the `LibraryController` is missing the check for admin user and thus allows a path traversal issue. Allowing non-admin users to write to any directory in the system can be seen as a form of path traversal. However, since it can be restricted to only admin permissions, fixing this is relatively simple and falls more into the realm of Role-Based Access Control (RBAC). This issue has been addressed in release version 2.13.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-22
• CWE-22

• https://github.com/advplyr/audiobookshelf-ghsa-gg56-vj58-g5mc/pull/1Broken Link
• https://github.com/advplyr/audiobookshelf/blob/1c0d6e9c670ebb1b6f1e427a4c4d9250a7fb9b80/server/controllers/LibraryController.js#L43-L47Product
• https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-gg56-vj58-g5mcExploit, Mitigation, Vendor Advisory

Published

Sep 2, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43791RequestStore provides per-request global storage for Rack. T…7.8
• CVE-2024-43792Halo is an open source website building tool. A security vul…6.1
• CVE-2024-43793Halo is an open source website building tool. A security vul…6.4
• CVE-2024-43794OpenSearch Dashboards Security Plugin adds a configuration m…6.1
• CVE-2024-43795OpenC3 COSMOS provides the functionality needed to send comm…6.1
• CVE-2024-43796Express.js minimalist web framework for node. In express < 4…4.7
• CVE-2024-43798Chisel is a fast TCP/UDP tunnel, transported over HTTP, secu…8.6
• CVE-2024-43799Send is a library for streaming files from the file system a…4.7
• CVE-2024-43800serve-static serves static files. serve-static passes untrus…4.7
• CVE-2024-43801Jellyfin is an open source self hosted media server. The Jel…5.4
• CVE-2024-43802Vim is an improved version of the unix vi text editor. When …4.5
• CVE-2024-43803The Bare Metal Operator (BMO) implements a Kubernetes API fo…4.9