Sarvar Omonov

**Name of the Vulnerable Software and Affected Versions** Audiobookshelf (affected versions not specified) **Description** An authentication bypass exists in the authentication-exemption check within `server/routers/Auth.js`. The system validates unauthenticated GET routes against `req.path` using a regex that expects a literal `/items/:id/cover` or `/authors/:id/image` structure. Because `req.path` retains URL-encoded `%2F` sequences while the Express router decodes the `:id` parameter before execution, an attacker can use `%2F`-encoded `../` sequences in the `:id` variable to bypass the check. The `CacheManager.handleCoverCache()` function then joins this decoded value into a cache file path and streams the file before any ownership verification occurs. This allows an unauthenticated user to perform an arbitrary file read of any file the service account can access that matches the pattern `* <width>[x<height>].<ext>`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mealie (affected versions not specified) **Description** The `AsyncSafeTransport` SSRF guard in `mealie/pkgs/safehttp/transport.py` fails to pin the validated IP address to the actual connection. The system resolves the target hostname to check it against private-range rules but then performs the outbound HTTP request using the original hostname, causing the transport to re-resolve the address. This allows a DNS-rebinding attack, where an attacker provides a public IP during validation and a private or metadata IP during the actual connection. Authenticated users can exploit this via the endpoints '/api/recipes/create/url', '/api/recipes/test-scrape-url', and '/api/recipes/{slug}/image' to read internal HTTP services and cloud-metadata endpoints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.