Live › vulnerability › CVE-2022-51024
Go to dashboardKavita, a self-hosted media server, versions 0.5.2 before 0.5.4.1 let unauthenticated users read arbitrary files by sending '../' sequences in the filename parameter of /api/image/cover-upload. An attacker can retrieve files such as appsettings.json, which can expose configuration secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed Kavita version; versions from 0.5.2 up to but not including 0.5.4.1 are affected.
Upgrade Kavita to 0.5.4.1 or later and rotate any secrets stored in appsettings.json.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
This page as .md · .json · in your agent: get_signal("CVE-2022-51024")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.