{"id":"CVE-2026-121544","kind":"vulnerability","aliases":["CVE-2026-121544"],"related":[],"title":"Koodo Reader: OPDS cover handler lets authenticated users read server files","description":"Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request /opds/cover/{key} to read files accessible to the server process.","summary":"Koodo Reader through 2.4.6 has a path traversal flaw in the OPDS handlers of its self-hosted HTTP server. An authenticated attacker can upload a crafted books.db with ../ sequences in a cover value and then read files the server process can access.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["koodo-reader","package","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check whether the Koodo Reader self-hosted HTTP server is running, which the sources imply is the affected mode.\n- Check the installed Koodo Reader version against the range in the sources (through `2.4.6`).","fix":"- Koodo Reader: unknown; the sources link a patch on github.com but do not state the fixed version here.","status":"open","published_at":"2026-11-03T16:17:25+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","triaged_at":"2026-11-03T16:23:59+00:00","updated_at":"2026-11-03T16:23:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T16:23:59Z","model":"claude-haiku-5-5","output":{"fix":"- Koodo Reader: unknown; the sources link a patch on github.com but do not state the fixed version here.","reach":"network","title":"Koodo Reader: OPDS cover handler lets authenticated users read server files","impact":"medium","summary":"Koodo Reader through 2.4.6 has a path traversal flaw in the OPDS handlers of its self-hosted HTTP server. An authenticated attacker can upload a crafted books.db with ../ sequences in a cover value and then read files the server process can access.","audience":"businesses","category":"package","nicknames":[],"who_cares":["koodo-reader","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"server files readable by the server process","analyst_note":"Confirm the fixed version from the github.com patch link and whether the self-hosted server is enabled by default.","how_to_check":"- Check whether the Koodo Reader self-hosted HTTP server is running, which the sources imply is the affected mode.\n- Check the installed Koodo Reader version against the range in the sources (through `2.4.6`).","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Only instances running the self-hosted HTTP server with OPDS handlers enabled are described as exposed. The attacker needs an authenticated account able to upload a books.db file. Installations that do not run the self-hosted server are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00069,"input_tokens":4189,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121544':14A,17A '-2026':13A,16A '/opds/cover':112C '2.4.6':28B,71C 'access':67B,117C 'allow':88C 'attack':47B,90C,98C 'authent':7A,46B,89C 'books.db':52B,103C 'contain':72C,108C 'cover':4A,57B,106C 'craft':51B,102C 'cve':12A,15A 'directori':97C 'file':11A,62B,93C,116C 'flaw':33B 'handler':5A,37B,86C 'host':24B,42B,81C 'http':43B,82C 'key':113C 'koodo':1A,19B,25B,68C 'koodo-read':18B 'let':6A 'opd':3A,36B,85C 'outsid':94C 'packag':21B 'path':31B,74C 'process':65B,121C 'read':9A,61B,92C,115C 'reader':2A,20B,26B,69C 'request':111C 'self':23B,41B,80C 'self-host':22B,40B,79C 'sequenc':54B,109C 'server':10A,44B,64B,83C,120C 'travers':32B,75C 'upload':49B,96C,100C 'user':8A 'valu':58B,107C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Only instances running the self-hosted HTTP server with OPDS handlers enabled are described as exposed. The attacker needs an authenticated account able to upload a books.db file. Installations that do not run the self-hosted server are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["koodoreader","medium","package","selfhosted"],"first_public_at":"2026-11-03T16:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121544","severity":null,"published_at":"2026-11-03T16:17:25+00:00","modified_at":"2026-11-03T16:17:25+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","fetched_at":"2026-11-03T16:21:43+00:00","note":null}],"documents":[{"id":58824,"url":"https://github.com/koodo-reader/koodo-reader/commit/cbc79a1ab5cbbd61c8252d6ab3cc6dbb694663b8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58825,"url":"https://www.vulncheck.com/advisories/koodo-reader-through-2.4.6-path-traversal-via-opds-cover-and-download-handlers","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}