Back to Database
Status published
High
CVE-2023-47619
Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability
Vulnerability Description
Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of time of publication, no patches are available.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-47619
Credits & Attribution
No credits recorded in the NVD database.
References
More from advplyr
View All →CVE-2025-57800
Audiobookshelf vulnerable to OIDC token exfiltration and account takeover
High
8.8
CVE-2025-46338
Audiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/upload
Medium
6.9
CVE-2025-25205
Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching
High
8.2
CVE-2024-43797
Path Traversal in audiobookshelf
Medium
6.3
CVE-2024-35236
Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks
Medium
4.8
Affected Vendor
advplyr
View all reports →Affected Software
audiobookshelf
Vulnerable Versions:
<= 2.4.3
Timeline
Official Publish:
December 13th, 2023
Last Modified:
May 22nd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N