CVE-2023-47619 Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability
Users with update permissions can read arbitrary files and perform server-side request forgery, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-47619?
CVE-2023-47619 is a high-severity server-side request forgery vulnerability in advplyr audiobookshelf, published on 13 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of time of publication, no patches are available.
Which versions are affected by CVE-2023-47619?
It affects 1 product.
Products include Audiobookshelf Audiobookshelf.
How do I fix CVE-2023-47619?
No fix has been published for CVE-2023-47619 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-47619 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-47619 exists.
Other vulnerabilities in advplyr audiobookshelf
- CVE-2025-57800 Audiobookshelf vulnerable to OIDC token exfiltration and account takeover
- CVE-2025-25205 Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching
- CVE-2023-47624 Audiobookshelf Arbitrary File Read Vulnerability
- CVE-2025-46338 Audiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/upload
- CVE-2024-43797 Path Traversal in audiobookshelf