CVE-2026-121544

Koodo Reader versions through 2.4.6 are vulnerable to a path traversal vulnerability (CWE-22) within the self-hosted HTTP server's OPDS handlers. The flaw allows authenticated attackers to read files outside the designated upload directory by uploading a crafted books.db file containing ../ seque...

CVE-2026-121544 Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlers

Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request...