CVE-2024-35236

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Attacking a user with high privileges (upload, creation of libraries) can lead to remote code execution (RCE) in the worst case. This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lead to RCE on Linux, too. Version 2.10.0 contains a patch for the vulnerability.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45d	Exploit
https://github.com/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/readers/EpubReader.vue#L319	Product
https://github.com/advplyr/audiobookshelf/commit/ce7f891b9b2cb57c6644aaf96f89a8bda6307664	Patch
https://github.com/advplyr/audiobookshelf/releases/tag/v2.10.0	Release Notes
https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg	Exploit Vendor Advisory
https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45d	Exploit
https://github.com/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/readers/EpubReader.vue#L319	Product
https://github.com/advplyr/audiobookshelf/commit/ce7f891b9b2cb57c6644aaf96f89a8bda6307664	Patch
https://github.com/advplyr/audiobookshelf/releases/tag/v2.10.0	Release Notes
https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:audiobookshelf:audiobookshelf:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-05-27 17:15

Updated : 2025-07-10 17:32

NVD link : CVE-2024-35236

Mitre link : CVE-2024-35236

CVE.ORG link : CVE-2024-35236

JSON object : View

Products Affected

audiobookshelf

audiobookshelf

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-35236", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2024-05-27T17:15:09.990", "references": [{"url": "https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45d", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://github.com/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/readers/EpubReader.vue#L319", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://github.com/advplyr/audiobookshelf/commit/ce7f891b9b2cb57c6644aaf96f89a8bda6307664", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/advplyr/audiobookshelf/releases/tag/v2.10.0", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45d", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/readers/EpubReader.vue#L319", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/advplyr/audiobookshelf/commit/ce7f891b9b2cb57c6644aaf96f89a8bda6307664", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/advplyr/audiobookshelf/releases/tag/v2.10.0", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Attacking a user with high privileges (upload, creation of libraries) can lead to remote code execution (RCE) in the worst case. This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lead to RCE on Linux, too. Version 2.10.0 contains a patch for the vulnerability."}, {"lang": "es", "value": "Audiobookshelf es un servidor de podcasts y audiolibros autohospedado. Antes de la versi\u00f3n 2.10.0, abrir un libro electr\u00f3nico con scripts maliciosos en su interior provocaba la ejecuci\u00f3n del c\u00f3digo dentro del contexto de navegaci\u00f3n. Atacar a un usuario con altos privilegios (carga, creaci\u00f3n de librer\u00edas) puede provocar la ejecuci\u00f3n remota de c\u00f3digo (RCE) en el peor de los casos. Esto se prob\u00f3 en la versi\u00f3n 2.9.0 en Windows, pero una escritura de archivo arbitraria es lo suficientemente potente como est\u00e1 y deber\u00eda conducir f\u00e1cilmente a RCE tambi\u00e9n en Linux. La versi\u00f3n 2.10.0 contiene un parche para la vulnerabilidad."}], "lastModified": "2025-07-10T17:32:33.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:audiobookshelf:audiobookshelf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEF91663-C22B-4BC7-BAA7-D28AEE1039DD", "versionEndExcluding": "2.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}