{"id":"CVE-2026-71209","published":"2026-08-05T08:16:43.110","lastModified":"2026-08-10T12:17:24.697","description":"audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/advplyr/audiobookshelf","tags":[]},{"url":"https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw","tags":[]},{"url":"https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw","tags":[]}],"exploitRefs":[{"url":"https://github.com/advplyr/audiobookshelf","tags":[]},{"url":"https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw","tags":[]},{"url":"https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows unauthenticated access to sensitive resources via URL-encoded paths, potentially enabling unauthorized data exposure.","exploitability":"Exploitation requires knowledge of specific URL patterns and decoded path sequences, making it moderately difficult but feasible with proper reconnaissance.","blast_radius":"If exploited, this could lead to significant data breaches affecting user privacy and system integrity.","remediation":"Implement strict authentication checks for all routes and validate URL paths before processing them.","tags":["auth-bypass","web","data-exposure","url-encoding"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:58:58.057Z"}}