CVE-2026-71209 — Audiobookshelf Path Traversal & Auth Bypass

Affected Asset

Audiobookshelf (self-hosted audiobook and podcast server) — versions before the patched release (2.21.0 or as noted in advisory GHSA-pg8v-5jcv-wrvw).

Affected Endpoint

Authentication exemption handler in server/routers/Auth.js (route parameter with %2F bypass).

Prerequisites

Audiobookshelf instance exposed to network; attacker can craft URL-encoded path sequences (%2F) targeting arbitrary file reads.

Steps to Reproduce

Send HTTP request with URL-encoded %2F sequences through the vulnerable route parameter; bypass the authentication exemption regex; read arbitrary files (e.g., /etc/passwd, application config, database files).

Evidence

Advisory from SentinelOne / NVD; GitHub security advisory GHSA-pg8v-5jcv-wrvw confirms unauthenticated arbitrary file read and authentication bypass.

Impact

Unauthenticated arbitrary file read; exposure of database contents, stored credentials, application secrets, and potential pivot to server-level access.

Root Cause

Authentication exemption regex does not account for URL-encoded %2F sequences in the route parameter, allowing bypass of the exemption check and arbitrary file access.

Remediation

Upgrade Audiobookshelf to the patched version (referenced in GHSA-pg8v-5jcv-wrvw); restrict inbound access via reverse proxy or VPN; review file access logs for unexpected requests.

Verification Steps

Confirm audiobookshelf version is >= 2.19.1 (check /api/health or package manager); test a cover URL with %2F and confirm it returns 403/404 instead of a cached file.

References

• SentinelOne — CVE-2026-71209
• GitHub Advisory — GHSA-pg8v-5jcv-wrvw