CVE-2026-121544

CVE-2026-121544CVE-2026-121544

Description

Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request /opds/cover/{key} to read files accessible to the server process.

Scoring

CVSS 4.9 ()
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Last modified2026-11-03
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.