The vulnerability in audiobookshelf's server/routers/Auth.js involves the authentication-exemption check matching unauthenticated-allowed GET routes against req.path using a regex that expects literal /items/:id/cover or /authors/:id/image patterns. However, req.path retains URL-encoded sequences such as %2F, which are decoded later and joined into a cache file path by CacheManager.handleCoverCache. This sequence allows an attacker to perform a path traversal attack by manipulating the encoded path segments, potentially accessing unauthorized cache files without passing database-backed ownership checks.

An unauthenticated attacker can exploit this path traversal vulnerability to access cached files on the server that should be protected, leading to unauthorized disclosure of potentially sensitive data. The vulnerability does not impact integrity or availability but has a high confidentiality impact as indicated by the CVSS score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected audiobookshelf version 2.19.1 and monitor for unusual access patterns. Avoid exposing the vulnerable endpoints publicly if possible.