CVE-2026-71209: Audiobookshelf Path Traversal Vulnerability

CVE-2026-71209 Overview

CVE-2026-71209 is an authentication bypass and path traversal vulnerability in audiobookshelf, a self-hosted audiobook and podcast server. The flaw resides in the authentication-exemption check in server/routers/Auth.js. Attackers can bypass the exemption regex by supplying URL-encoded %2F sequences within the :id route parameter. Express decodes route parameters before handler execution, so a payload such as ..%2f..%2f..%2ftmp%2fpwned passes the literal-path check while resolving to a path traversal once decoded. This regression reintroduces the class of issue previously fixed as CVE-2025-25205, permitting unauthenticated arbitrary file read.

Critical Impact
Unauthenticated remote attackers can read arbitrary files accessible to the audiobookshelf service account that match the pattern *_<width>[x<height>].<ext>.

Affected Products

audiobookshelf (self-hosted audiobook and podcast server)
Versions relying on the CVE-2025-25205 exemption regex fix in server/routers/Auth.js
Deployments exposing the /items/:id/cover or /authors/:id/image routes

Discovery Timeline

2026-08-05 - CVE-2026-71209 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71209

Vulnerability Analysis

The vulnerability is a Path Traversal issue tracked as [CWE-22]. The authentication-exemption check compares req.path against a regex anchored to the literal shapes /items/:id/cover and /authors/:id/image. In Express, req.path preserves percent-encoded sequences such as %2F, so a payload containing %2F in the :id position still satisfies the anchored literal-path regex.

When the request reaches the route handler, Express decodes the :id route parameter. The decoded ..%2f..%2f..%2ftmp%2fpwned becomes ../../../tmp/pwned. CacheManager.handleCoverCache then joins the decoded value into a cache file path and streams the resulting file back to the caller. No database-backed ownership or authentication check runs before file resolution.

Root Cause

The root cause is a mismatch between the string used for authorization (req.path, still percent-encoded) and the string used for filesystem resolution (the decoded route parameter). The exemption regex was tightened in CVE-2025-25205 to anchor the literal path, but the fix did not normalize or reject percent-encoded slashes inside :id. This allows the same input to appear benign to the auth layer and malicious to the file-access layer.

Attack Vector

An unauthenticated attacker issues an HTTP GET request to /items/<encoded-traversal>/cover or /authors/<encoded-traversal>/image. The :id segment contains %2F-encoded ../ sequences pointing at a target file on disk. The request must resolve to a filename matching the cache pattern *_<width>[x<height>].<ext>, which constrains but does not prevent extraction of readable files owned by the audiobookshelf process user. See the GitHub Security Advisory GHSA-pg8v-5jcv-wrvw for the full technical write-up.

Detection Methods for CVE-2026-71209

Indicators of Compromise

HTTP GET requests to /items/ or /authors/ paths containing %2F or %2f sequences within the :id segment.
Access log entries where the requested URI includes ..%2f, %2e%2e%2f, or double-encoded traversal patterns.
audiobookshelf process reading files outside its media, metadata, or cache directories.
Unauthenticated 200 OK responses on /items/*/cover or /authors/*/image endpoints returning non-image content.

Detection Strategies

Alert on web server or reverse proxy logs containing encoded traversal tokens in audiobookshelf request URIs.
Baseline expected :id values (UUIDs or numeric IDs) and flag deviations containing % characters.
Correlate audiobookshelf file-open telemetry with paths outside its designated storage roots.

Monitoring Recommendations

Ingest audiobookshelf access logs and reverse-proxy logs into a central analytics platform for pattern queries.
Monitor outbound response sizes on /cover and /image endpoints for anomalies indicating non-image payloads.
Track file-access syscalls from the audiobookshelf service account and alert on reads outside the media library and cache directories.

How to Mitigate CVE-2026-71209

Immediate Actions Required

Upgrade audiobookshelf to the patched version referenced in GHSA-pg8v-5jcv-wrvw.
Restrict inbound access to audiobookshelf to authenticated users through a reverse proxy or VPN until patched.
Run the audiobookshelf process under a least-privilege service account with read access limited to the media library.
Audit access logs for %2F or %2f sequences in /items/ and /authors/ URIs since the deployment date.

Patch Information

The maintainers of audiobookshelf published the fix and advisory at GHSA-pg8v-5jcv-wrvw. Refer to the audiobookshelf project repository for the release containing the corrected authentication-exemption logic and input normalization for the :id route parameter.

Workarounds

Place audiobookshelf behind a reverse proxy that rejects requests containing %2F, %2f, or double-encoded traversal sequences in the path.
Require authentication at the proxy layer for /items/*/cover and /authors/*/image routes.
Deny the audiobookshelf process filesystem access to sensitive directories using mandatory access control or container mounts.

bash

# Example NGINX rule to block encoded slashes in audiobookshelf paths
if ($request_uri ~* "%2f|%2F|%252f|%252F") {
    return 400;
}