audiobookshelf CVE-2026-71209

The /items/:id/cover and /authors/:id/image GET endpoints are explicitly exempted from authentication to support public cover art display - this is a deliberate design feature that the auth bypass leverages. Exploitation requires: (1) the audiobookshelf HTTP service is reachable by the attacker over the network; (2) the attacker crafts a :id parameter containing %2F-encoded directory traversal sequences (e.g., ..%2f..%2f); and (3) the target file on disk matches the naming pattern *_<width>[x<height>].<ext> (such as config_800x600.json or key_100.pem), since CacheManager enforces this pattern when constructing the cache file path. No authentication, no special server configuration, and no user interaction are required beyond a default audiobookshelf installation with cover art serving enabled. Exploitation is limited by the filename suffix constraint - attackers cannot read arbitrary files but must find or enumerate files whose names conform to the cache naming convention that the service account can read.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately characterizes this as a high-severity, easily exploitable flaw: it is reachable over the network with no authentication, no user interaction, and no special configuration. The confidentiality impact is constrained by one practical factor - readable files must match the filename pattern *_<width>[x<height>].<ext> (e.g., secret_100x100.png), which limits arbitrary file disclosure to files whose names conform to that cache naming convention. This reduces exploitation to a moderate-effort enumeration exercise rather than a fully open file read, but does not drop the real-world priority, particularly for deployments where sensitive files on disk might coincidentally match the pattern. The bypass of a prior patch (CVE-2025-25205) increases confidence that the vulnerability is genuine and that the underlying encoding normalization issue is systemic. No CISA KEV listing and no confirmed public POC at time of analysis; however, the zero-prerequisite attack profile is consistent with rapid weaponization once the advisory is public. EPSS data was not provided, but the AV:N/AC:L/PR:N/UI:N profile is historically associated with above-median exploitation probability.

An unauthenticated attacker sends a crafted HTTP GET request such as GET /items/..%2f..%2f..%2fetc%2fpwned_100x100.png/cover to a publicly accessible audiobookshelf instance; the auth-exemption regex in Auth.js passes the request because req.path retains the encoded slashes, matching the exempted route shape. Express decodes the :id parameter to ../../etc/pwned_100x100.png before CacheManager.handleCoverCache constructs the filesystem path, and the server streams back any readable file whose name matches the *_<width>[x<height>].<ext> pattern. No public exploit code has been confirmed at time of analysis, but the exploit primitive is straightforward HTTP request crafting requiring no tooling beyond curl.