CVE-2026-121544 in Koodo Reader
Summary
by MITRE • 11/03/2026
Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request /opds/cover/{key} to read files accessible to the server process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
Koodo Reader versions up through 2.4.6 are susceptible to a critical path traversal vulnerability within its self-hosted HTTP server implementation, specifically affecting the Open Publication Distribution System (OPDS) handlers. This flaw arises from insufficient validation of user-supplied input during the processing of book metadata, allowing authenticated attackers to exploit improper handling of file paths. The vulnerability centers on the cover image functionality, where a crafted database file can be uploaded containing maliciously constructed values in the cover field that include directory traversal sequences such as ../. When these sequences are processed without proper sanitization or canonicalization checks, they enable an attacker to break out of the intended upload directory and access arbitrary files on the host system accessible by the server process privileges.
The technical mechanism involves the manipulation of the books.db file, which serves as the local database for storing book metadata in Koodo Reader. An authenticated user can inject path traversal characters into the cover URL field within this database structure. Subsequently, when an HTTP request is made to the /opds/cover/{key} endpoint using a key derived from or associated with the malicious entry, the server attempts to resolve and serve the specified image file. Due to the lack of robust input validation, the application resolves these relative paths against the filesystem root rather than restricting access strictly within the designated upload directory. This behavior effectively bypasses security boundaries intended to isolate user-uploaded content from sensitive system files or other users' data.
From an operational perspective, this vulnerability poses a significant risk as it facilitates unauthorized information disclosure. An attacker with valid credentials can leverage this flaw to read configuration files, source code, environment variables, or any other file accessible by the application's runtime account. This could lead to further compromise scenarios where sensitive internal infrastructure details are exposed, potentially aiding in more advanced attacks such as remote code execution if combined with other vulnerabilities. The impact is particularly severe because it requires only authentication rather than network-level access control bypasses, making it exploitable against any legitimate user of the self-hosted instance who can upload content or manipulate their own library metadata through API interactions or direct database manipulation tools.
This vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within a file path that could cause the path to reference files outside of the intended directory. Additionally, in terms of tactical classification under MITRE ATT&CK, this behavior corresponds to T1083: File and Directory Discovery, as it allows an attacker to enumerate and access restricted directories for intelligence gathering purposes. The exploitation chain also reflects aspects of CWE-20: Improper Input Validation, highlighting the failure to adequately sanitize or validate user-controlled input before its use in file system operations.
Mitigation strategies should prioritize immediate patching to version 2.4.7 or later where this issue has been addressed by developers through enhanced path normalization and strict directory confinement checks. In environments where upgrading is not immediately feasible, administrators can implement network-level controls such as web application firewalls configured to detect and block requests containing ../ sequences in URL parameters related to file serving endpoints. Furthermore, restricting the permissions of the Koodo Reader process account on the operating system level ensures that even if path traversal occurs, the attacker cannot access sensitive files outside a minimal set of required directories. Regular audits of uploaded content metadata and limiting user privileges to only necessary operations can further reduce the attack surface associated with this type of vulnerability.