The vulnerability lies in Audiobookshelf's implementation of the POST /api/filesystem/pathexists endpoint, which uses String.startsWith() to verify that a resolved file path remains inside a configured library folder. The check incorrectly allows sibling directories that share a common prefix (for example, /audiobooks vs /audiobooks-private) to bypass the restriction, letting an authenticated user probe whether files exist outside the permitted library directory. This flaw can expose the existence of arbitrary files on the host file system, providing limited information disclosure. The weakness aligns with CWE‑22, which describes path traversal or relative path referencing.

Audiobookshelf by advplyr, version 2.32.1 and earlier. The issue is fixed starting with 2.32.2. The vulnerability applies to installations that expose the POST /api/filesystem/pathexists endpoint and configure multiple libraries whose names share prefixes.

The CVSS score of 4.3 indicates moderate severity, reflecting that the flaw only enables file existence checks and does not allow code execution or privilege escalation. EPSS data is not available, so the current likelihood of exploitation remains uncertain. The vulnerability is not yet listed in CISA’s KEV catalog. Attackers must be authenticated and possess upload permission within Audiobookshelf to exploit the flaw, so the attack vector is limited to a trusted user. Still, the ability to discover out‑of‑scope files can assist in reconnaissance for future attacks.