Threats tagged 'ghsa-xh68-jpqj-pv76'

Koodo Reader versions through 2.4.6 have a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers. Authenticated attackers can exploit this by uploading a crafted books.db file with directory traversal sequences in the cover value, enabling them to read arbitrary files accessible to the server process outside the intended upload directory.