Path Traversal Vulnerability in Kavita by Kareadita
CVE-2022-51024

8.7HIGH

Key Information:

Vendor

Kareadita

Status
Kavita
Vendor
CVE Published:
22 October 2026

What is CVE-2022-51024?

Kavita versions prior to 0.5.4.1 are susceptible to a path traversal vulnerability. This flaw allows unauthenticated attackers to exploit the '/api/image/cover-upload' endpoint by manipulating the filename parameter with '../' sequences. This can lead to unauthorized access to sensitive files including configuration files like 'appsettings.json'. Such vulnerabilities were noted by the Shadowserver Foundation as of October 18, 2023, highlighting the need for immediate remediation measures.

Affected Version(s)

Kavita 0.5.2 < 0.5.4.1

References

https://huntr.com/bounties/2eef332b-65d2-4f13-8c39-44a877...
technical-description
https://github.com/Kareadita/Kavita/commit/88b5ebeb6
patch
https://github.com/projectdiscovery/nuclei-templates/blob...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Shadowserver Foundation
.