CVE-2026-121544: Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlers
Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request /opds/cover/{key} to read files accessible to the server process.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the self-hosted Koodo Reader HTTP server and able to upload a crafted books.db file. The issue affects the OPDS cover handler.
What access can an attacker gain?
A successful attacker can read files outside the upload directory, limited to files that are accessible to the server process. The vulnerability does not state that files can be modified or deleted.
How is the traversal triggered?
The attacker places ../ sequences in a cover value within a crafted books.db, then requests the corresponding /opds/cover/{key} endpoint.