The vulnerability in audiobookshelf 2.19.1 involves the authentication-exemption check in server/routers/Auth.js, which matches unauthenticated-allowed GET routes against the raw request path using a regex expecting literal /items/:id/cover or /authors/:id/image patterns. Since req.path retains URL-encoded sequences like %2F, an attacker can include encoded '../' sequences in the :id parameter. Express decodes this parameter before handler execution, causing the decoded path to traverse directories. This bypasses the previous fix for CVE-2025-25205 and results in CacheManager.handleCoverCache joining the decoded path into a cache file path and streaming it without ownership verification, enabling unauthenticated arbitrary file reads of files matching the pattern *_<width>[x<height>].<ext> accessible by the service account.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the server that match the specified filename pattern and are accessible by the audiobookshelf service account. This can lead to disclosure of sensitive information without requiring authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the audiobookshelf service and monitor for suspicious requests attempting path traversal. Avoid exposing the service to untrusted networks.