The vulnerability in Kavita allows an unauthenticated attacker to read arbitrary files from the server by sending a specially crafted GET request to the /api/image/cover-upload endpoint. By supplying directory traversal sequences in the filename parameter, the application passes the file name straight to a file read operation, enabling access to configuration files such as appsettings.json located outside the designated temporary directory. This flaw qualifies as a path traversal (CWE-22) and results in a confidentiality impact by exposing sensitive information that can be leveraged for further compromise.

The affected product is Kavita, developed by Kareadita. Versions prior to 0.5.4.1 of the application contain the flaw. It includes earlier releases such as 0.5.2 through 0.5.4.0. Users running any of these versions are at risk. The patch that resolves the issue is included in release 0.5.4.1 and later.

The CVSS score of 8.7 classifies the bug as high severity. The EPSS score is not publicly available, so the current exploit probability is unclear, but the lack of an authentication requirement means the attack vector is a simple HTTP request from any remote host. The vulnerability is not listed in the CISA KEV catalog, yet the ease of exploitation and the potential disclosure of configuration files suggest a high risk to affected systems. Reputational and operational impacts can follow if sensitive configuration data is exfiltrated.