AudiobookShelf’s authentication‑exemption logic incorrectly allows URLs containing encoded "\%2F" sequences. While the regex for exempt routes checks against the literal path "\/items\/\:id\/cover" or "\/authors\/\:id\/image", Express decodes the :id parameter before the handler runs. An attacker can supply a chain of "..\%2F" segments in the :id field (e.g., "..\%2F..\%2F..\%2Ft…") that passes the literal regex check but resolves to a real filesystem path after decoding. The application then materialises this decoded value into a cache file path and streams the resulting file to the client before any ownership validation is performed. Consequently, any file matching the pattern "*_<width>[x<height>].<ext>" that the service account can read becomes arbitrarily readable by unauthenticated users.

The vulnerability affects the AudiobookShelf product from advplyr. No specific version information is provided in the available data; therefore, all released versions of AudiobookShelf that still use the affected authentication-exemption implementation are potentially impacted.

The CVSS score of 7.5 indicates a high‑severity issue. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation activity to date. However, the attack vector is straightforward: an unauthenticated HTTP GET request to a cover or author image route containing encoded path‑traversal segments will bypass authentication checks and retrieve arbitrary files. Because no database ownership check precedes the file read, the full impact is the uncontrolled exposure of sensitive files under cover image naming conventions. This makes the vulnerability a prime target for attackers seeking data exfiltration from the service.