Is CVE-2026-121544 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121544?

CVE-2026-121544 has a CVSS v3 severity of MEDIUM (4.9).

Back

CVE-2026-121544

Description

Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request /opds/cover/{key} to read files accessible to the server process.