CVE-2026-121544 — Vulnerability intelligence
—
Published:
- CVSS
- 6.9
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request /opds/cover/{key} to read files accessible to the server process.