CVE-2024-35236 Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks
Attackers can execute arbitrary code via malicious ebooks, potentially leading to remote code execution if high-privilege users are targeted.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-35236?
CVE-2024-35236 is a medium-severity cross-site scripting vulnerability in advplyr audiobookshelf, published on 27 May 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Attacking a user with high privileges (upload, creation of libraries) can lead to remote code execution (RCE) in the worst case. This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lead to RCE on Linux, too. Version 2.10.0 contains a patch for the vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2024-35236?
It affects 1 product.
Products include Audiobookshelf Audiobookshelf.
How do I fix CVE-2024-35236?
No fix has been published for CVE-2024-35236 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-35236 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-35236 exists.
Other vulnerabilities in advplyr audiobookshelf
- CVE-2025-57800 Audiobookshelf vulnerable to OIDC token exfiltration and account takeover
- CVE-2025-25205 Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching
- CVE-2023-47619 Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability
- CVE-2023-47624 Audiobookshelf Arbitrary File Read Vulnerability
- CVE-2025-46338 Audiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/upload
Sources
Also known as GHSA-7j99-76cj-q9pg.