Back to Database
Status published
High
CVE-2023-47624
Audiobookshelf Arbitrary File Read Vulnerability
Vulnerability Description
Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, any user (regardless of their permissions) may be able to read files from the local file system due to a path traversal in the `/hls` endpoint. This issue may lead to Information Disclosure. As of time of publication, no patches are available.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-47624
Credits & Attribution
No credits recorded in the NVD database.
References
More from advplyr
View All →CVE-2025-57800
Audiobookshelf vulnerable to OIDC token exfiltration and account takeover
High
8.8
CVE-2025-46338
Audiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/upload
Medium
6.9
CVE-2025-25205
Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching
High
8.2
CVE-2024-43797
Path Traversal in audiobookshelf
Medium
6.3
CVE-2024-35236
Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks
Medium
4.8
Affected Vendor
advplyr
View all reports →Affected Software
audiobookshelf
Vulnerable Versions:
<= 2.4.3
Timeline
Official Publish:
December 13th, 2023
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N