CVE-2026-71209

{"id": "CVE-2026-71209", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71209", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T13:21:06.583401Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "advplyr", "product": "audiobookshelf", "versions": [{"status": "affected", "version": "2.19.1", "versionType": "custom", "lessThanOrEqual": "2.35.1"}], "programFiles": ["server/routers/Auth.js", "server/managers/CacheManager.js"], "defaultStatus": "unknown"}]}], "published": "2026-08-05T08:16:43.110", "references": [{"url": "https://github.com/advplyr/audiobookshelf", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check."}, {"lang": "es", "value": "La comprobaci\u00f3n de exenci\u00f3n de autenticaci\u00f3n de audiobookshelf (servidor/routers/Auth.js) compara rutas GET permitidas sin autenticaci\u00f3n con req.path mediante una expresi\u00f3n regular que requiere una forma literal de /items/:id/cover o /authors/:id/image, donde req.path retiene secuencias %2F codificadas en URL. El router de Express decodifica el par\u00e1metro de ruta :id antes de que se ejecute el c\u00f3digo del gestor, por lo que una secuencia \u2019.. / \u2019 codificada en %2F en :id (p. ej., ..%2f..%2f..%2ftmp%2fpwned) pasa la comprobaci\u00f3n de exenci\u00f3n de autenticaci\u00f3n de ruta literal mientras se resuelve en una carga \u00fatil de path traversal real una vez decodificada. CacheManager.handleCoverCache luego une este valor decodificado en una ruta de archivo de cach\u00e9 y transmite el resultado antes de cualquier comprobaci\u00f3n de propiedad respaldada por la base de datos. Esto elude la correcci\u00f3n aplicada para CVE-2025-25205 (que ancl\u00f3 la expresi\u00f3n regular de exenci\u00f3n y la cambi\u00f3 a req.path) y resulta en una lectura de archivo arbitraria no autenticada de cualquier archivo que coincida con el patr\u00f3n *_[width][x[height]].[ext] que la cuenta de servicio pueda leer."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}