Authentication Exemption Vulnerability in Audiobookshelf by Advplyr

CVE-2026-71209

What is CVE-2026-71209?

The vulnerability in Audiobookshelf occurs due to a flaw in the application’s authentication mechanism, where certain unauthenticated GET requests are improperly validated. Specifically, when users attempt to access cover images or author images, the application fails to correctly enforce access controls due to the way URL paths are processed. The regex for determining access exemptions mistakenly allows encoded paths that, when decoded, can lead to a path traversal condition, enabling unauthenticated users to read arbitrary files. This issue bypasses an earlier fix aimed at enhancing security around file access and opens up significant risks to sensitive file exposure.

References