CVE Feed

    Dashboard / CVE / CVE-2024-35236

    CVE-2024-35236

    Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Attacking a user with high privileges (upload, creation of libraries) can lead to remote code execution (RCE) in the worst case. This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lead to RCE on Linux, too. Version 2.10.0 contains a patch for the vulnerability.

    Published:May 27, 2024
    Last Modified:Jul 10, 2025
    EPS:May 27, 2024
    EPSS Score:0.01115
    CVSS Score:4.8

    Affected Products

    Vendor
    Advplyr
    Product
    Audiobookshelf
    Vendor
    Audiobookshelf
    Product
    Audiobookshelf

    Exploits

    https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45dhttps://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pghttps://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45dhttps://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg

    Related CVEs

    CVE-2026-73085 (CVSS 5.3) — Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in se…
    CVE-2026-71209 (CVSS 7.5) — audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET r…
    CVE-2026-42888 (CVSS 6.9) — Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the podcast creation endpoint a…
    CVE-2026-42887 (CVSS 4.5) — Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.33.0, a stored cross-site scripting (…
    CVE-2026-42886 (CVSS 4.9) — Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/backups/upload en…
    CVE-2026-42885 (CVSS 4.3) — Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathex…
    CVE-2026-42884 (CVSS 4.3) — Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/collections and GE…
    CVE-2026-42883 (CVSS 6.5) — Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/libraries/:id/down…
    CVE-2026-27974 (CVSS 4.8) — Audiobookshelf is a self-hosted audiobook and podcast server. A cross-site scripting (XSS) vulnerability exist…
    CVE-2026-27963 (CVSS 4.8) — Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerabilit…

    References

    https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45d
    https://github.com/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/readers/EpubReader.vue#L319
    https://github.com/advplyr/audiobookshelf/commit/ce7f891b9b2cb57c6644aaf96f89a8bda6307664
    https://github.com/advplyr/audiobookshelf/releases/tag/v2.10.0
    https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg
    https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45d
    https://github.com/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/readers/EpubReader.vue#L319
    https://github.com/advplyr/audiobookshelf/commit/ce7f891b9b2cb57c6644aaf96f89a8bda6307664
    https://github.com/advplyr/audiobookshelf/releases/tag/v2.10.0
    https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High