{"id":"CVE-2022-51024","aliases":[],"url":"https://o3.security/vulnerability/CVE-2022-51024","summary":"Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint","details":"Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.","published":"2026-10-22T10:57:34.599Z","modified":"2026-10-23T02:45:06.052303447Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/Kareadita/Kavita/commit/88b5ebeb6","label":"Kareadita/Kavita@88b5ebe"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51024.json"},{"type":"PACKAGE","url":"https://github.com/Kareadita/Kavita"},{"type":"FIX","url":"https://github.com/Kareadita/Kavita/commit/88b5ebeb6"},{"type":"ARTICLE","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/kavita-lfi.yaml"},{"type":"ARTICLE","url":"https://huntr.com/bounties/2eef332b-65d2-4f13-8c39-44a8771a6f18"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51024"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/kavita-0.5.4.1-unauthenticated-path-traversal-via-cover-upload-endpoint"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-23T02:45:06.052303447Z"}}