audiobookshelf_PathTraversal_01 Vulnerability Report

We discovered a Path Traversal vulnerability in the audiobookshelf project.

Overview

• Vulnerability Type: Path Traversal
• Affected Location: server/controllers/PodcastController.js:61-77,127-130
• Trigger Scenario: Podcast creation endpoint allows path traversal outside the selected library folder

Root Cause

User-controlled input reaches sensitive security paths without strict authorization checks or boundary validation (path/scheme/channel), enabling reliable exploitation.

Source-to-Sink Chain

1. Source (user-controlled input)

• Entry point: the attacker-controlled input path that reaches server/controllers/PodcastController.js:76.

2. Data flow

• Code analysis shows concrete propagation into this sink:
  • vulnerability title: Podcast creation endpoint allows path traversal outside the selected library folder
  • sink location reached by attacker-controlled input: server/controllers/PodcastController.js:76
• The same sink behavior is confirmed by controlled execution observations.

3. Sink (dangerous operation)

• Sink location: server/controllers/PodcastController.js:61-77,127-130
• Vulnerable behavior: Podcast creation endpoint allows path traversal outside the selected library folder

Exploitation Preconditions

1. The attacker can influence file path related input.
2. Path canonicalization, boundary checks, or symlink handling is insufficient.
3. The runtime account has filesystem permissions for the affected operation.

Risk

This issue breaks intended filesystem boundaries and exposes unauthorized file operations.

Impact

An attacker may read, write, or delete files outside intended directories depending on reachable sink behavior.

Remediation

1. Enforce strict allowlist-based input validation before sensitive sinks.
2. Add explicit authorization and containment checks for privileged flows.
3. Add regression tests for this exact exploit chain.