CVE-2022-51024 in Kavita
Summary
by MITRE • 10/22/2026
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Kavita versions prior to 0.5.4.1 represents a critical path traversal flaw that compromises the integrity and confidentiality of server-side data. This security defect stems from insufficient validation of user-supplied input within the filename parameter used by the application's image processing endpoints. Specifically, when an unauthenticated attacker submits GET requests targeting the /api/image/cover-upload endpoint with carefully crafted filenames containing directory traversal sequences such as ../, the underlying file system operations fail to properly sanitize these inputs. Consequently, instead of restricting access to designated temporary directories or intended resource locations, the application resolves the path relative to the root filesystem context, allowing the retrieval of arbitrary files stored on the server. This lack of input validation is a classic example of CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which remains one of the most prevalent and dangerous web application vulnerabilities due to its potential for widespread data exposure.
The operational impact of this vulnerability is severe, as it grants unauthenticated actors direct read access to sensitive configuration files and potentially other critical system resources. By exploiting this flaw, an attacker can retrieve files such as appsettings.json or similar configuration artifacts that often contain database connection strings, API keys, authentication secrets, and internal service endpoints. The exposure of these credentials enables further stages of attack, including credential stuffing, lateral movement within the network, or complete compromise of the Kavita instance by leveraging stolen administrative tokens. Furthermore, if other sensitive files like source code or environment variables are accessible, attackers could gain deeper insights into the application's architecture and logic, facilitating more sophisticated exploits such as remote code execution via deserialization flaws or SQL injection using extracted database credentials. The presence of this vulnerability effectively neutralizes any authentication controls that might otherwise protect these resources, rendering them publicly accessible to anyone on the internet with knowledge of the endpoint structure.
Evidence of active exploitation for this specific path traversal flaw was first documented by the Shadowserver Foundation on October 18, 2023, indicating that threat actors are actively scanning and targeting unpatched instances in the wild. This real-world exploitation context underscores the urgency of remediation beyond theoretical risk assessments. The attack vector aligns with ATT&CK technique T1530: Data from Local System, where adversaries collect data stored on local drives or within file systems to support subsequent objectives such as credential harvesting or reconnaissance. Given that Kavita is a self-hosted media server often deployed in home lab environments or small business infrastructures without robust perimeter defenses like Web Application Firewalls, the risk of automated exploitation by bots scanning for known CVEs is exceptionally high. These automated scanners routinely probe for common API endpoints and parameter patterns associated with path traversal vulnerabilities, making unpatched systems highly susceptible to immediate compromise upon exposure to the internet.
To mitigate this vulnerability, administrators must immediately upgrade Kavita to version 0.5.4.1 or later, where the developers have implemented proper input sanitization and strict directory restriction mechanisms for file handling operations. Until an upgrade is feasible, temporary mitigations include restricting access to the /api/image/cover-upload endpoint via network-level controls such as IP whitelisting in a reverse proxy or firewall configuration, ensuring that this API path is not exposed directly to untrusted networks. Additionally, deploying a Web Application Firewall with rulesets tuned for detecting directory traversal patterns can provide an additional layer of defense by blocking requests containing ../ sequences before they reach the application logic. Regular security audits and penetration testing should be conducted on self-hosted applications to identify similar input validation weaknesses in other endpoints, ensuring that all file operations adhere to the principle of least privilege and strictly confine access to intended directories without relying solely on client-side or superficial server-side checks.