CVE-2026-71209Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-08-11); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

pdnuclei-bot@pdnuclei_bot45d
Disclosure
🚨 CVE-2026-71209 - critical 🚨 Audiobookshelf - Authentication Bypass > Audiobookshelf contains a path traversal caused by improper authentication-exemption ... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-71209 @pdnuclei #NucleiTemplates #cve
Post summary
The post announces the critical CVE‑2026‑71209, describes a path traversal authentication bypass in Audiobookshelf, but provides no PoC, exploit, or patch information.
00031327
1.3K followersView on X
Halil Deniz@denizhalilT44d
Disclosure
🚨 Critical flaw in Audiobookshelf! CVE-2026-71209 allows unauthenticated remote attackers to bypass auth and read arbitrary host files via path traversal. Check out the technical deep dive and remediation guide now: https://denizhalil.com/2026/08/12/cve-2026-71209-audiobookshelf-authentication-bypass-path-traversal/ #CyberSecurity #Vulnerability https://t.co/G5qgi1UFgP
Post summary
The tweet announces a critical vulnerability in Audiobookshelf, describes its impact as an unauthenticated path traversal leading to arbitrary file read, and points to a remediation guide for mitigation.
0001051
32 followersView on X

Explore more

Back to dashboard