CVE-2022-51024
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory.
Risk Assessment
Configuration files containing secrets and credentials may be read, potentially leading to application compromise. This breaches confidentiality and system integrity.
Recommendation
Upgrade Kavita to version 0.5.4.1 or later and verify path validation for the filename parameter. Review logs for path traversal attempts against /api/image/cover-upload.
Other vulnerabilities in Kavita
See all- CVE-2026-47202Critical
Improper token validation vulnerability in Kavita prior to 0.9.0.2. A remote, unauthenticated attacker can obtain a JWT for any user (including admins) given knowledge of their username.
- CVE-2026-110223Low
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host rebinds or redirects to internal addresses after validation, enabling blind internal port and service probing.
- CVE-2026-44776Medium
Kavita, a cross-platform reading server, has a vulnerability in download and size-check endpoints. A low-privileged user can access content from libraries they are not assigned to if they know the chapter, volume, or series IDs.
- CVE-2026-44775Medium
In Kavita prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing unauthenticated access to page images from any chapter in any library. The apiKey parameter is not validated, and entity IDs are sequential, enabling easy enumeration of all server content.
Original NVD description (English source)
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS