Kavita: Path traversal vulnerability (CVE-2022-51024)

Kavita versions prior to 0.5.4.1 are susceptible to a path traversal vulnerability. Unauthenticated attackers can exploit the 'filename' parameter within the '/api/image/cover-upload' endpoint to access files outside of the intended directory by injecting directory traversal sequences (e.g., '../'). The Shadowserver Foundation observed in-the-wild exploitation of this vulnerability beginning on 2023-10-18.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files from the server's filesystem, including sensitive configuration files such as 'appsettings.json'.

Recommendation

• Update Kavita to version 0.5.4.1 or later immediately.
• Audit server access logs for requests to '/api/image/cover-upload' containing directory traversal sequences ('../').
• Restrict network access to the Kavita management interface to trusted subnets.