HIGHVulnerability
Verified
Global
NVD HIGH: CVE-2022-51024 — Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows ...
·Source: NIST NVD
Updated:
Executive Summary
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the S
Analysis
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18. CVSS Score: 7.5. Published: 2026-10-22T11:17:05.447.