Unauthenticated Path Traversal in Kavita 0.5.2 Lets Attackers Steal Files
CVE-2022-51024 allows remote attackers to read arbitrary files in Kavita versions prior to 0.5.4.1 without authentication.
Key points
- CVE-2022-51024 is a high-severity path traversal flaw in Kavita before version 0.5.4.1.
- Attackers can retrieve sensitive configuration files by manipulating the filename parameter.
- Shadowserver Foundation observed exploitation attempts starting in October 2023.
Kavita versions prior to 0.5.4.1 contain a high-severity path traversal vulnerability that allows unauthenticated attackers to read arbitrary files. The flaw, tracked as CVE-2022-51024, enables remote exploitation through simple GET requests.
What happened
The vulnerability exists in the Kareadita Kavita application, specifically affecting versions older than 0.5.4.1. According to the National Vulnerability Database record, the issue stems from improper validation of the filename parameter. Attackers can supply sequences such as '../' to traverse directories outside the intended temporary folder.
This specific weakness is classified under CWE-22 and carries a CVSS score of 8.7, placing it in the high severity category. The flaw allows an attacker to access files that should be restricted from external view. No authentication is required to trigger the exploit, making it accessible to anyone on the internet.
Exploitation evidence was first observed by the Shadowserver Foundation on October 18, 2023. The group detected attackers sending GET requests to the /api/image/cover-upload endpoint. By setting the filename value to paths like ../appsettings.json, they successfully retrieved configuration files.
Why it matters
Exposing configuration files can reveal database credentials, API keys, or internal network structures. As Patch Gazette reported on October 22, 2026, similar path traversal bugs in plugins like TinyMCE have led to significant data theft. That suggests that unpatched instances of Kavita face similar risks of credential exposure.
The ease of exploitation increases the risk profile for any publicly accessible server running affected versions. Since the attack requires no login, automated scanners can quickly identify and exploit vulnerable systems. This mirrors the high-severity SvelteKit flaw reported on October 21, 2026, which also targeted unauthenticated file access.
What to watch
- Monitor server logs for GET requests to the /api/image/cover-upload endpoint.
- Look for unusual filename parameters containing '../' sequences in access logs.
- Check for unauthorized access attempts to sensitive files like appsettings.json.
- Verify that all Kavita instances are running version 0.5.4.1 or later.
Who needs to act first
Teams should prioritize updating any publicly accessible Kavita servers immediately. Exposure should be reduced by restricting access to the application via firewall rules if an update cannot be applied instantly. It is advisable to test the update in a non-production environment before rolling it out broadly. Backing up current configurations ensures that settings are preserved during the upgrade process.
Background: APIs
APIs in healthcare allow different software systems to exchange patient data automatically. They streamline care coordination but introduce significant security risks if access controls are weak. You must enforce strict authentication, limit data exposure, and monitor traffic patterns to prevent unauthorized access or data leaks in these critical integrations.
Read the full guide: APIs in Healthcare: Secure Data Exchange Without Breaches
What to do and how to stay safe: Kavita
- Verify the current version of Kavita installed on all servers.
- Update to version 0.5.4.1 or later as soon as possible.
- Review server logs for signs of past exploitation attempts.
- Restrict network access to the application if immediate patching is not possible.
Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Kavita are affected by CVE-2022-51024?
All versions of Kareadita Kavita prior to 0.5.4.1 are affected.
Is authentication required to exploit this vulnerability?
No, the vulnerability allows unauthenticated attackers to exploit the flaw.
What was the first observed date of exploitation?
Exploitation evidence was first observed by Shadowserver on October 18, 2023.
