Technical impact
AudiobookShelf’s authentication‑exemption logic matches GET routes against req.path using a regex that requires the literal segments "/items/:id/cover" or "/authors/:id/image". The regex is applied before Express decodes the :id parameter, so a request containing URL‑encoded forward‑slash (%2F) sequences bypasses the check. The application then decodes the id, incorporates it directly into a cache file path, and streams that file to the client without performing any ownership or permission validation. Consequently, an unauthenticated user can craft a request such as "/items/..%2F..%2Fsecret.txt/cover" to read any file accessible to the service process, satisfying the CWE‑22 path‑traversal category.
Affected Systems
The vulnerability affects the AudiobookShelf product from advplyr. No specific version information is provided in the available data; therefore, all released versions of AudiobookShelf that still use the affected authentication‑exemption implementation are potentially impacted.
Risk and Exploitability
The CVSS score of 7.5 indicates a high‑severity issue. The EPSS score is 2%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation activity to date. However, the attack vector is straightforward: an unauthenticated HTTP GET request to a cover or author image route containing encoded path‑traversal segments bypasses authentication checks and retrieves arbitrary files. Because no database ownership check precedes the file read, the full impact is the uncontrolled exposure of sensitive files under cover image naming conventions. This makes the vulnerability a prime target for attackers seeking data exfiltration from the service.
