Kavita vulnerabilities
CVEs whose affected-version data names the Kavita package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2022-51024High· 7.5Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover…
▾ TwilightKareadita · Kavitavia CVEORG
CVE-2026-110223Low· 3.1Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-c…
▾ SunlitKareadita · KavitaEPSS 0.28%via NVD