Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Vendor: Kareadita Clear all filters
TI-2022-26712 CVE-2022-51024 · GHSA-558q-5f3p-2qrg

Path traversal in Kavita lets unauthenticated attackers read files

Priority HIGH 77

Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00613 Published 2026-10-22 Fixed in 0.5.4.1 CWE-22
TI-2026-73440 CVE-2026-110223 · GHSA-r6xw-vr9q-6g8x

SSRF blocklist bypass in Kavita via upload-cbl-file endpoint

Priority LOW 12

Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00279 Published 2026-10-13 No fix listed CWE-918
TI-2026-34790 CVE-2026-47202

Kavita: Pre-Auth Account Takeover

Priority MEDIUM 47

Kavita is a cross platform reading server.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00171 Published 2026-05-26 Fixed in 0.9.0.2 CWE-287
TI-2026-32661 CVE-2026-44776

Kavita: IDOR in /api/Download/*

Priority MEDIUM 60

Kavita is a cross platform reading server.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.0025 Published 2026-05-26 Fixed in 0.9.0 CWE-639
TI-2022-02553 CVE-2022-2756 · GHSA-v6vr-jvvr-p4m5

Server-Side Request Forgery (SSRF) in kareadita/kavita

Priority LOW 35

Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03472 Published 2022-08-10 Fixed in 0.5.4.1 CWE-918