CVE-2025-46338

MEDIUM

Audiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/upload

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-46338 has a selected CVSS score of 6.9 (medium).

Description

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.21.0, an improper input handling vulnerability in the `/api/upload` endpoint allows an attacker to perform a reflected cross-site scripting (XSS) attack by submitting malicious payloads in the `libraryId` field. The unsanitized input is reflected in the server’s error message, enabling arbitrary JavaScript execution in a victim's browser. This issue has been patched in version 2.21.0.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 29, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

audiobookshelf

Browse advplyr / audiobookshelf
CVE List< 2.21.0affected

References

2