CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated users to exploit a flaw in audiobookshelf's authentication-exemption check, enabling them to perform path traversal attacks by manipulating URL-encoded sequences in the :id parameter. This results in unauthorized access to arbitrary files that match specific patterns, potentially exposing sensitive information. Organizations using audiobookshelf should prioritize patching this vulnerability to prevent unauthorized file access and protect sensitive data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.