What is the CVSS score of EUVD-2026-53206?

EUVD-2026-53206 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Which versions of audiobookshelf are affected by EUVD-2026-53206?

Audiobookshelf contains an unauthenticated file-read vulnerability (CVE-2026-71209) that bypasses authentication controls for cover art requests, allowing remote attackers to read arbitrary files…

Is there a public PoC exploit available for EUVD-2026-53206?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53206. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate EUVD-2026-53206?

Within 24 hours, audit all internet-facing audiobookshelf instances for exposure and either take servers offline or restrict network access to trusted IP ranges only; review server access logs for suspicious cover-art requests using encoded path patterns (%2F sequences) to identify potential exploitation attempts. Within 7 days, implement compensating controls including Web Application Firewall (WAF) rules to block requests with URL-encoding bypass patterns in cover-art paths, disable the cover-art feature if not business-critical, and segregate audiobookshelf instances to internal networks only. Within 30 days, establish daily monitoring of vendor security advisories and audiobookshelf release channels for patch availability; prepare for immediate upgrade to patched version when released, and conduct comprehensive audit of any files potentially accessed during the exposure window.

audiobookshelf EUVD-2026-53206

| CVE-2026-71209 HIGH

Path Traversal (CWE-22)

2026-08-05 TuranSec

GHSA-8885-9f28-m6p3

Path Traversal Audiobookshelf

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable cover art endpoint requires no auth; file read only with no integrity or availability impact; AC:L despite filename pattern constraint because attacker controls traversal path construction.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 07:58 vuln.today

CVE Published

Aug 05, 2026 - 06:59 cve.org

HIGH 7.5

DescriptionCVE.org

audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express's router decodes the :id route parameter before handler code runs, so a %2F-encoded '../' sequence in :id (e.g. ..%2f..%2f..%2ftmp%2fpwned) passes the literal-path auth-exemption check while resolving to a real path-traversal payload once decoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check. This bypasses the fix applied for CVE-2025-25205 (which anchored the exemption regex and switched it to req.path) and results in unauthenticated arbitrary file read of any file matching the pattern *_<width>[x<height>].<ext> that the service account can read.

AnalysisAI

Unauthenticated arbitrary file read in audiobookshelf exploits a URL-encoding normalization gap between the Express authentication-exemption regex (which reads raw percent-encoded req.path) and Express's route parameter decoder (which decodes %2F sequences before handler execution), allowing any remote attacker to traverse the filesystem via crafted cover art requests. This directly bypasses the prior fix for CVE-2025-25205, which had anchored the auth-exemption regex to req.path - meaning the root cause was incompletely remediated. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send unauthenticated GET to /items/..%2F-traversal-path/cover

Delivery

Auth-exemption regex passes on encoded req.path

Exploit

Express decodes :id to filesystem traversal string

Execution

CacheManager joins decoded path into cache file path

Impact

Server streams matching file contents to attacker

Access

Send unauthenticated GET to /items/..%2F-traversal-path/cover

Delivery

Auth-exemption regex passes on encoded req.path

Exploit

Express decodes :id to filesystem traversal string

Execution

CacheManager joins decoded path into cache file path

Impact

Server streams matching file contents to attacker

Vulnerability AssessmentAI

Exploitation	The /items/:id/cover and /authors/:id/image GET endpoints are explicitly exempted from authentication to support public cover art display - this is a deliberate design feature that the auth bypass leverages. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately characterizes this as a high-severity, easily exploitable flaw: it is reachable over the network with no authentication, no user interaction, and no special configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends a crafted HTTP GET request such as GET /items/..%2f..%2f..%2fetc%2fpwned_100x100.png/cover to a publicly accessible audiobookshelf instance; the auth-exemption regex in Auth.js passes the request because req.path retains the encoded slashes, matching the exempted route shape. Express decodes the :id parameter to ../../etc/pwned_100x100.png before CacheManager.handleCoverCache constructs the filesystem path, and the server streams back any readable file whose name matches the *_<width>[x<height>].<ext> pattern. …
Remediation	Upgrade audiobookshelf to the version that addresses GHSA-pg8v-5jcv-wrvw per the vendor security advisory at https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit all internet-facing audiobookshelf instances for exposure and either take servers offline or restrict network access to trusted IP ranges only; review server access logs for suspicious cover-art requests using encoded path patterns (%2F sequences) to identify potential exploitation attempts. …

Threat intelligence, references, and detailed analysis are available after sign-in.