CVE-2025-46338 is a reflected cross-site scripting (XSS) vulnerability affecting Audiobookshelf, a self-hosted audiobook and podcast server, in versions prior to 2.21.0. An unauthenticated attacker can exploit improper input handling in the /api/upload endpoint by injecting malicious JavaScript into the libraryId field, which is then reflected in error messages. This allows for arbitrary JavaScript execution in a victim's browser, potentially leading to session hijacking or data theft. The vulnerability has a CVSS score of 6.1 (Medium), indicating a network-based attack with low complexity requiring user interaction, resulting in low impact to confidentiality and integrity. While the EPSS score is low, suggesting limited current exploitability, the FAUCET Risk Score is 54/100, highlighting a moderate overall risk. Currently, there is no evidence of active exploitation (not in KEV or Hot List), and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also minimal, suggesting low public awareness of this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.21.0CPE matchmatch criteria | cpe:2.3:a:audiobookshelf:audiobookshelf:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.