https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 01:32:19 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349621 EUVD-2026-349621 https://cve.radiocsirt.org/vuln/euvd-2026-349621 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71209 <p>audiobookshelf&#39;s authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.</p> <p>audiobookshelf&#39;s authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71209 https://cve.radiocsirt.org/vuln/ghsa-8885-9f28-m6p3 <p>audiobookshelf&#39;s authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express&#39;s router decodes the :id route parameter before handler code runs, so a %2F-encoded &#39;../&#39; sequence in :id (e.g. ..%2f..%2f..%2ftmp%2fpwned) passes the literal-path auth-exemption check while resolving to a real path-traversal payload once decoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check. This bypasses the fix applied for CVE-2025-25205 (which anchored the exemption regex and switched it to req.path) and results in unauthenticated arbitrary file read of any file matching the pattern *_&lt;width&gt;[x&lt;height&gt;].&lt;ext&gt; that the service account can read.</p> <p>audiobookshelf&#39;s authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express&#39;s router decodes the :id route parameter before handler code runs, so a %2F-encoded &#39;../&#39; sequence in :id (e.g. ..%2f..%2f..%2ftmp%2fpwned) passes the literal-path auth-exemption check while resolving to a real path-traversal payload once decoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check. This bypasses the fix applied for CVE-2025-25205 (which anchored the exemption regex and switched it to req.path) and results in unauthenticated arbitrary file read of any file matching the pattern *_&lt;width&gt;[x&lt;height&gt;].&lt;ext&gt; that the service account can read.</p> https://cve.radiocsirt.org/vuln/ghsa-8885-9f28-m6p3