CVE-2026-71209

Name of the Vulnerable Software and Affected Versions Audiobookshelf (affected versions not specified)

Description An authentication bypass exists in the authentication-exemption check within server/routers/Auth.js. The system validates unauthenticated GET routes against req.path using a regex that expects a literal /items/:id/cover or /authors/:id/image structure. Because req.path retains URL-encoded %2F sequences while the Express router decodes the :id parameter before execution, an attacker can use %2F-encoded ../ sequences in the :id variable to bypass the check. The CacheManager.handleCoverCache() function then joins this decoded value into a cache file path and streams the file before any ownership verification occurs. This allows an unauthenticated user to perform an arbitrary file read of any file the service account can access that matches the pattern * <width>[x<height>].<ext>.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.