PT-2025-43409 · Booklore · Booklore

Published 2025-10-22 · Updated 2025-10-27 · CVE-2025-62614

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions BookLore versions 1.8.1 and prior

Description BookLore is a self-hosted web app for managing book collections. Versions prior to a recent update have an authentication bypass issue in the BookMediaController. This allows unauthenticated users to access and download book covers, thumbnails, and complete PDF/CBZ page content without authorization. The issue stems from missing access control annotations on multiple media endpoints and the CoverJwtFilter continuing request processing even without an authentication token. This enables attackers to enumerate and exfiltrate book content, bypassing download permissions. The issue was addressed with commit b226c43.

Recommendations Update BookLore to a version later than 1.8.1.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-62614

GHSA-363G-FHCQ-HVQP

Affected Products

Booklore

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62614.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62614 · Security Note
• https://github.com/booklore-app/booklore/security/advisories/GHSA-363g-fhcq-hvqp · Note
• https://github.com/booklore-app/booklore/commit/b226c43343cd0cef4c1cd54bc3dcdef90b147133 · Note
• https://twitter.com/CveFindCom/status/1981105720146706454 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1981118286130552964 · Twitter Post
• https://t.me/CVEtracker/35526 · Telegram Post
• https://twitter.com/CVEnew/status/1981219898991731025 · Twitter Post
• https://t.me/cveNotify/140447 · Telegram Post