Koodo Reader CVE-2026-121544

Requires the optional self-hosted HTTP server (OPDS) mode of Koodo Reader to be enabled and reachable - this is not the default desktop-only usage. The attacker must be authenticated with privileges to upload a books.db (PR:H), supply a crafted 'cover' value containing ../ sequences, and then request /opds/cover/{key}. Impact is bounded to reading files accessible to the server process (read-only disclosure, no write/integrity or availability impact). Limiting factors: authenticated upload access is mandatory, the self-hosted server must be deployed and exposed, and only files the server process can already read are disclosed. Affects versions through 2.4.6; upgrading to the patched build (commit cbc79a1) is the vendor fix.

This is a medium-severity, authenticated information-disclosure flaw rather than a top-tier emergency. The supplied CVSS 4.0 vector (6.9) shows a network-reachable, low-complexity bug (AV:N/AC:L/AT:N) but requires high privileges (PR:H) and yields confidentiality impact only (VC:H, VI:N, VA:N), with no scope/subsequent-system impact - consistent with read-only path traversal (CWE-22). The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', so the signals converge on prompt-but-not-urgent remediation. No EPSS score was provided in the input, so exploitation probability cannot be quantified here, and the vulnerability is NOT listed in CISA KEV - there is no evidence of active exploitation. No public exploit code was identified in the input; the strongest corroboration is a VulnCheck advisory plus the vendor patch commit and the exact vulnerable source lines (httpserver/opds.go). The main factor keeping real-world risk moderate is PR:H: an attacker must already be an authenticated user able to upload a books.db to the self-hosted server. Because the self-hosted HTTP server is an optional, non-default deployment mode, the exposed population is narrow. Net: credible and patch-worthy, but limited by the authentication requirement and read-only impact - not a widespread, pre-auth RCE scenario.

An authenticated user of a self-hosted Koodo Reader HTTP server uploads a crafted books.db whose 'cover' value contains ../ traversal sequences, then requests /opds/cover/{key}; the server's unsanitized filepath.Join resolves outside the upload directory and returns files readable by the server process (e.g., configuration or credential files). The CVSS vector indicates network vector with low attack complexity but high privilege (authenticated upload) required. No public exploit code was identified at time of analysis; a VulnCheck advisory and the patch commit confirm the mechanism.