CVE-2026-71209

audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

2.00% chance of exploitation in the next 30 days, 79th percentile

Nuclei

critical · CWE-287

Published

2026-08-05

Updated

2026-08-10

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-71209.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2026-71206
• CVE-2026-7121
• CVE-2026-71205
• CVE-2026-71211
• CVE-2026-71204
• CVE-2026-7122