CVE-2026-71209 advplyr CVE debrief

Who should care

Users of audiobookshelf, especially those hosting the application publicly or with sensitive data, should be aware of this HIGH-severity vulnerability and take immediate action to protect their systems. This includes reviewing and applying vendor patches or updates, restricting access to sensitive files and directories, and implementing additional authentication and authorization checks for file access. System administrators and security teams responsible for managing audiobookshelf deployments should prioritize patching and mitigation efforts to prevent potential unauthorized access to sensitive information. Additionally, operators of audiobookshelf should verify the integrity of their systems and monitor for any suspicious activity that could indicate exploitation of this vulnerability. Vulnerability management and security teams should also review the affected scope and severity to ensure proper prioritization and resource allocation for remediation efforts. Those responsible for asset inventory and configuration management should ensure that all instances of audiobookshelf are accounted for and updated accordingly. Furthermore, security teams should consider implementing compensating controls, such as monitoring and detection mechanisms, to identify and respond to potential security incidents related to this vulnerability. Finally, change management and incident response teams should be prepared to address any issues that may arise during the remediation process and to respond to potential security incidents related to this vulnerability. IT and security teams should collaborate to ensure that all necessary measures are taken to protect against exploitation of this vulnerability in audiobookshelf deployments. Those responsible for source tracking and vulnerability management should also verify that all affected systems are properly patched and that any necessary follow-up actions are taken to ensure the security of audiobookshelf deployments. Overall, a coordinated effort across various teams is necessary to effectively address this vulnerability and minimize potential risks to audiobookshelf deployments. Security teams should also review relevant monitoring

Technical summary

The audiobookshelf authentication-exemption check can be bypassed due to improper handling of URL-encoded path parameters, allowing for unauthenticated arbitrary file reads. The vulnerability exists in the server/routers/Auth.js file and affects the CacheManager.handleCoverCache function. This bypasses the fix applied for CVE-2025-25205, which anchored the exemption regex and switched it to req.path. As a result, an attacker can read arbitrary files from the system, including files matching the pattern *_<width>[x<height>].<ext> that the service account can read.

Defensive priority

Authenticated attackers may leverage this HIGH-severity vulnerability (CVSS 7.5) to read arbitrary files from the system.

Recommended defensive actions

• Review and apply vendor patches or updates for audiobookshelf.
• Restrict access to sensitive files and directories.
• Implement additional authentication and authorization checks for file access.
• Verify the integrity of audiobookshelf systems and monitor for suspicious activity.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE description indicates that audiobookshelf's authentication-exemption check can be bypassed, allowing for unauthenticated arbitrary file reads. The fix for CVE-2025-25205 was also bypassed. Limited information is available about the specific affected versions or configurations.

Official resources