Live › vulnerability › CVE-2026-121544
Koodo Reader through 2.4.6 has a path traversal flaw in the OPDS handlers of its self-hosted HTTP server. An authenticated attacker can upload a crafted books.db with ../ sequences in a cover value and then read files the server process can access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Only instances running the self-hosted HTTP server with OPDS handlers enabled are described as exposed. The attacker needs an authenticated account able to upload a books.db file. Installations that do not run the self-hosted server are not described as affected.
No product ranges from the sources yet.
2.4.6).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request /opds/cover/{key} to read files accessible to the server process.
This page as .md · .json · in your agent: get_signal("CVE-2026-121544")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.