Vulnerability Description
audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express's router decodes the :id route parameter before handler code runs, so a %2F-encoded '../' sequence in :id (e.g. ..%2f..%2f..%2ftmp%2fpwned) passes the literal-path auth-exemption check while resolving to a real path-traversal payload once decoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check. This bypasses the fix applied for CVE-2025-25205 (which anchored the exemption regex and switched it to req.path) and results in unauthenticated arbitrary file read of any file matching the pattern *_<width>[x<height>].<ext> that the service account can read.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/advplyr/audiobookshelf
- https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrv
- https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrv
FAQ
What is CVE-2026-71209?
CVE-2026-71209 is a vulnerability with a CVSS score of 7.5 (HIGH). audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/im...
How severe is CVE-2026-71209?
CVE-2026-71209 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-71209?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.