audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a lit…

CVE-2026-71209 describes a path traversal vulnerability in audiobookshelf's authentication-exemption logic in server/routers/Auth.js. The regex used to allow unauthenticated GET requests for cover images matches against req.path, which retains URL-encoded %2F sequences. However, Express decodes route parameters like :id before handler execution, allowing a crafted payload such as ..%2f..%2f..%2ftmp%2fpwned to bypass the auth check while resolving as a real directory traversal. The CacheManager.handleCoverCache function then uses this decoded value to construct a file path and streams the file back without any ownership verification. This effectively allows unauthenticated arbitrary file reads for files matching the pattern *_<width>[x<height>].<ext> accessible to the service account. The vulnerability bypasses the previously applied fix for CVE-2025-25205, which had anchored the exemption regex and switched to req.path matching. The issue is tracked in the audiobookshelf GitHub repository and associated security advisory GHSA-pg8v-5jcv-wrvw.