Kavita vulnerabilities

2 known vulnerabilities in Kavita from Kareadita. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Kavita: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2022-51024Oct 22, 2026Kareadita

  Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename v

• 9.3 Critical severity

  Kavita: Improper Authentication

  CVE-2026-47202May 26, 2026Kareadita

  Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user including admins given knowledge of their username. This vulnerability is fixed in 0.