{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2022-51024/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kavitareader:kavita:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2022-51024"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kavita (0.5.2 \u003c= version \u003c 0.5.4.1)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","path-traversal","cve-2022-51024"],"_cs_type":"threat","_cs_vendors":["Kavita"],"content_html":"\u003cp\u003eKavita versions prior to 0.5.4.1 are susceptible to a path traversal vulnerability. Unauthenticated attackers can exploit the 'filename' parameter within the '/api/image/cover-upload' endpoint to access files outside of the intended directory by injecting directory traversal sequences (e.g., '../'). The Shadowserver Foundation observed in-the-wild exploitation of this vulnerability beginning on 2023-10-18.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read arbitrary files from the server's filesystem, including sensitive configuration files such as 'appsettings.json'.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Kavita to version 0.5.4.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit server access logs for requests to '/api/image/cover-upload' containing directory traversal sequences ('../').\u003c/li\u003e\n\u003cli\u003eRestrict network access to the Kavita management interface to trusted subnets.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T14:15:54Z","date_published":"2026-10-22T14:15:54Z","id":"https://feed.craftedsignal.io/briefs/2026-10-kavita-path-traversal/","summary":"Kavita versions 0.5.2 through 0.5.4.0 contain a path traversal vulnerability in the /api/image/cover-upload endpoint, allowing unauthenticated attackers to read arbitrary files.","title":"Kavita: Path traversal vulnerability (CVE-2022-51024)","url":"https://feed.craftedsignal.io/briefs/2026-10-kavita-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2022-51024","version":"https://jsonfeed.org/version/1.1"}