Server-Side Request Forgery Vulnerability in Kavita by Kareadita
CVE-2026-110223

2.3LOW

Key Information:

Vendor

Kareadita

Status
Kavita
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110223?

Versions 0.9.0 to 0.9.1.4 of Kavita are affected by a server-side request forgery vulnerability that allows authenticated users to circumvent existing SSRF protections. This exploit can be executed by submitting a specially crafted URL to the upload endpoint, which, upon validation, can rebind or redirect to internal network addresses. This leads to potential blind internal service and port probing, effectively enabling attackers to gain insights into protected resources within the network.

Affected Version(s)

Kavita 0.9.0 <= 0.9.1.4

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kavita-cbl-url-...
third-party-advisory
https://github.com/Kareadita/Kavita/blob/879b8b73eb41d66f...
technical-description
https://github.com/Kareadita/Kavita/blob/879b8b73eb41d66f...
technical-description

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.