---
id: CVE-2026-121544
title: Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlers
summary: >-
  Koodo Reader through 2.4.6 contains a path traversal vulnerability in the
  self-hosted HTTP server's OPDS handlers that allows authenticated attackers to
  read files outside the upload directory. Attackers can upload a crafted
  books.db wit…
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: koodo-reader
product: koodo-reader
affected:
  - koodo-reader <= 2.4.6
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T16:48:49.441924Z'
exploitAvailable: true
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T16:49:21.690Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121544'
references:
  - url: 'https://github.com/koodo-reader/koodo-reader/issues/1654'
    label: 'GitHub Issue #1654'
  - url: 'https://github.com/koodo-reader/koodo-reader'
  - url: >-
      https://github.com/koodo-reader/koodo-reader/commit/cbc79a1ab5cbbd61c8252d6ab3cc6dbb694663b8
    label: Fix commit
  - url: >-
      https://github.com/koodo-reader/koodo-reader/blob/v2.4.6/httpserver/opds.go#L167-L194
  - url: >-
      https://github.com/koodo-reader/koodo-reader/blob/v2.4.6/httpserver/opds.go#L384-L431
  - url: >-
      https://github.com/koodo-reader/koodo-reader/compare/205539043b0a2afd9fd8bf99ef8434bd1833c2bf...cbc79a1ab5cbbd61c8252d6ab3cc6dbb694663b8
  - url: >-
      https://www.vulncheck.com/advisories/koodo-reader-through-2.4.6-path-traversal-via-opds-cover-and-download-handlers
    label: >-
      VulnCheck Advisory: Koodo Reader through 2.4.6 Path Traversal via OPDS
      Cover and Download Handlers
tags:
  - cve.org
  - exploit-available
epss: 0.00637
epssPercentile: 0.50801
ingestedAt: '2026-11-05T20:33:06.292Z'
---

## Overview

Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request /opds/cover/{key} to read files accessible to the server process.

## Affected

- `koodo-reader <= 2.4.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.