PT-2026-22118 · Unknown · Audiobookshelf

Michael-Tyl · Published 2026-02-26 · Updated 2026-02-26 · CVE-2026-27963

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Audiobookshelf versions prior to 2.32.0

Description Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) issue exists that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration.

Recommendations Update to version 2.32.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27963

GHSA-69CP-M725-WF78

Affected Products

Audiobookshelf

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27963.json · Exploit
• https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78 · Vendor Advisory
• https://github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27963 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27963 · Vendor Advisory
• https://t.me/CVEtracker/45825 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026937147509363052 · Twitter Post
• https://twitter.com/CVEnew/status/2027004205915836493 · Twitter Post