{"id":"CVE-2026-121544","title":"Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlers","summary":"Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db wit…","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-22"],"vendor":"koodo-reader","product":"koodo-reader","affected":["koodo-reader <= 2.4.6"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T16:48:49.441924Z"},"exploitAvailable":true,"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T16:49:21.690Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121544","references":[{"url":"https://github.com/koodo-reader/koodo-reader/issues/1654","label":"GitHub Issue #1654"},{"url":"https://github.com/koodo-reader/koodo-reader"},{"url":"https://github.com/koodo-reader/koodo-reader/commit/cbc79a1ab5cbbd61c8252d6ab3cc6dbb694663b8","label":"Fix commit"},{"url":"https://github.com/koodo-reader/koodo-reader/blob/v2.4.6/httpserver/opds.go#L167-L194"},{"url":"https://github.com/koodo-reader/koodo-reader/blob/v2.4.6/httpserver/opds.go#L384-L431"},{"url":"https://github.com/koodo-reader/koodo-reader/compare/205539043b0a2afd9fd8bf99ef8434bd1833c2bf...cbc79a1ab5cbbd61c8252d6ab3cc6dbb694663b8"},{"url":"https://www.vulncheck.com/advisories/koodo-reader-through-2.4.6-path-traversal-via-opds-cover-and-download-handlers","label":"VulnCheck Advisory: Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlers"}],"tags":["cve.org","exploit-available"],"epss":0.00637,"epssPercentile":0.50801,"ingestedAt":"2026-11-05T20:33:06.292Z","slug":"CVE-2026-121544","body":"## Overview\n\nKoodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request /opds/cover/{key} to read files accessible to the server process.\n\n## Affected\n\n- `koodo-reader <= 2.4.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":27,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}