Cpe:2.3:a:kavitareader:kavita:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3akavitareaderkavita/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 14:15:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKavita: Path traversal vulnerability (CVE-2022-51024)https://feed.craftedsignal.io/briefs/2026-10-kavita-path-traversal/Thu, 22 Oct 2026 14:15:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-kavita-path-traversal/Kavita versions 0.5.2 through 0.5.4.0 contain a path traversal vulnerability in the /api/image/cover-upload endpoint, allowing unauthenticated attackers to read arbitrary files.Kavita versions prior to 0.5.4.1 are susceptible to a path traversal vulnerability. Unauthenticated attackers can exploit the 'filename' parameter within the '/api/image/cover-upload' endpoint to access files outside of the intended directory by injecting directory traversal sequences (e.g., '../'). The Shadowserver Foundation observed in-the-wild exploitation of this vulnerability beginning on 2023-10-18.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files from the server's filesystem, including sensitive configuration files such as 'appsettings.json'.

Recommendation

  • Update Kavita to version 0.5.4.1 or later immediately.
  • Audit server access logs for requests to '/api/image/cover-upload' containing directory traversal sequences ('../').
  • Restrict network access to the Kavita management interface to trusted subnets.
]]>highthreatweb-application-vulnerabilitypath-traversalcve-2022-51024