CVE-2026-71209
- Source
- https://cve.org/CVERecord?id=CVE-2026-71209
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71209.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-71209
- Aliases
-
- CVE-2025-25205
- GHSA-pg8v-5jcv-wrvw
- Published
- 2026-08-05T06:59:16.579Z
- Modified
- 2026-08-07T11:56:15.237604250Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- audiobookshelf: %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal
- Details
-
audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express's router decodes the :id route parameter before handler code runs, so a %2F-encoded '../' sequence in :id (e.g. ..%2f..%2f..%2ftmp%2fpwned) passes the literal-path auth-exemption check while resolving to a real path-traversal payload once decoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check. This bypasses the fix applied for CVE-2025-25205 (which anchored the exemption regex and switched it to req.path) and results in unauthenticated arbitrary file read of any file matching the pattern *_<width>[x<height>].<ext> that the service account can read.
- Database specific
{ "cwe_ids": [ "CWE-22" ], "cna_assigner": "TuranSec", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71209.json" }- References