---
id: "CVE-2022-51024"
kind: "vulnerability"
aliases: ["CVE-2022-51024"]
title: "Kavita: path traversal lets anyone without login read server files"
severity: "high"
cvss: 8.7
epss: 0.00389
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["kavita", "other", "self-hosted"]
not_affected_if: ["version-outside-0.5.2-to-0.5.4.0"]
published_at: "2026-10-22T11:17:05+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-51024", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-51024", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Kavita: path traversal lets anyone without login read server files

Kavita, a self-hosted media server, versions 0.5.2 before 0.5.4.1 let unauthenticated users read arbitrary files by sending '../' sequences in the filename parameter of /api/image/cover-upload. An attacker can retrieve files such as appsettings.json, which can expose configuration secrets.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed Kavita version; versions from 0.5.2 up to but not including 0.5.4.1 are affected.

## Fix

Upgrade Kavita to 0.5.4.1 or later and rotate any secrets stored in appsettings.json.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-51024
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-51024

## From the sources

Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_