koodo-reader vulnerabilities

Products

• koodo-reader/koodo-reader 2

Latest koodo-reader CVEs

Newest publication first

1. CVE-2026-121544 Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlers

   Published 2026-11-03

   Medium·CVSS 6.9 EPSS 0.64%

   Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, t...

2. CVE-2026-55408 Koodo Reader: Remote code execution via malicious epub file

   Published 2026-07-07

   High·CVSS 8.4 EPSS 0.25%

   Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution through malicious EPUB files because the open-book IPC handler enables nodeIntegrationInSubFrames and EPUB chapter content is rendered with unsanitized innerHTML. An...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.